CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon (nfsd) for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service (DoS). This occurs when the nfsd4_alloc_layout_stateid function accesses a file pointer without proper locking during a concurrent delegation revoke, which can be orchestrated by two NFS clients interacting with the same file.

A race in nfsd4_alloc_layout_stateid can occur when the SC_TYPE_DELEG path reads fp fi_deleg_file without holding fi_lock while the laundromat may revoke the delegation and clear the same pointer under fi_lock. A remote NFS client reachable to the export can hit this window during delegation recall and pNFS LAYOUTGET processing, causing nfsd_file_get to return NULL and triggering a BUG_ON that crashes the kernel. For the CVSS the PR:L value is used because the attacker normally needs access to the NFS export and valid NFS operations, but does not need local code execution on the server. The issue is network reachable through NFS server request handling, although reliable triggering requires a race involving delegation recall, revoke, and a concurrent LAYOUTGET. Impact is at least remote denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because the unlocked pointer read is a plausible stale pointer or UAF candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.