CVE-2026-89681 Overview
CVE-2026-89681 is a race condition in the Linux kernel's NFS server (nfsd) layout fencing logic. The flaw resides in lm_breaker_timedout(), where a call to delayed_work_pending() can return false while the fence worker is already executing. The workqueue core clears WORK_STRUCT_PENDING before invoking the callback, opening a window during which a duplicate sc_count reference is taken. That reference is never released, leaking the layout stateid and corrupting reference counting on NFSv4.1+ pNFS layouts.
Critical Impact
Concurrent layout recall processing on an NFS server can leak layout stateids, exhaust kernel memory, and destabilize the nfsd subsystem over time.
Affected Products
- Linux kernel builds that include the pNFS layout fencing logic in fs/nfsd
- Distributions shipping affected mainline and -stable kernel branches prior to the fix commits
- NFS server deployments serving pNFS layouts to NFSv4.1+ clients
Discovery Timeline
- 2026-09-11 - CVE-2026-89681 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89681
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the nfsd layout fencing path. When a layout is recalled and the client fails to respond within the lease grace period, lm_breaker_timedout() is invoked to fence the layout. The function guarded scheduling of the fence worker with delayed_work_pending() to avoid duplicate work.
The Linux workqueue core clears WORK_STRUCT_PENDING before invoking the worker callback. The pending flag therefore reads false while the worker is actively running. A concurrent breaker call then takes a second reference on sc_count via refcount_inc_not_zero() and calls mod_delayed_work(), which coalesces into the in-progress execution rather than scheduling a new run. The additional reference is never dropped, leaving the layout stateid pinned in memory indefinitely.
Repeated triggering under contended pNFS workloads leaks kernel memory and prevents cleanup of NFS4 state, degrading server availability and potentially exhausting resources.
Root Cause
The root cause is reliance on delayed_work_pending() as a synchronization primitive. The pending bit does not remain set for the lifetime of the worker execution, so it cannot serve as an in-flight indicator. The fix replaces the check with an explicit ls_fence_inflight boolean set atomically alongside refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path. The self-rearming mod_delayed_work() at the top of the worker is removed.
Attack Vector
An attacker with network access to an NFS server exporting pNFS layouts can induce layout recalls that time out, forcing the fencing path. Repeated, concurrent layout operations exercise the race window between worker dispatch and the pending flag clear. The vulnerability is exploitable over the network without authentication in scenarios where NFS shares accept client mounts. Successful exploitation produces kernel memory exhaustion and denial of service against nfsd.
See the upstream fix commits 8580571227451384399b3fa53fcde19848c48e5a and a278d361e0e8f242211891193d56483a7a9f47a8 for the code-level changes.
Detection Methods for CVE-2026-89681
Indicators of Compromise
- Steady growth in kernel slab memory attributed to NFS state objects such as nfs4_layout_stateid
- Rising nfsd thread counts or blocked worker threads without a corresponding client workload increase
- Frequent CB_LAYOUTRECALL timeouts in server logs correlated with unreleased stateids
Detection Strategies
- Monitor kernel version against the fixed commits and flag hosts running unpatched nfsd builds
- Track /proc/slabinfo for anomalous growth in NFS-related caches over time
- Correlate NFS layout recall events with subsequent memory pressure or OOM conditions on file servers
Monitoring Recommendations
- Enable nfsd tracepoints such as nfsd_layout_recall* to observe fencing behavior under load
- Alert on repeated nfs4_put_stid() imbalances surfaced by kernel warnings or refcount debug builds
- Collect kernel and workqueue telemetry into a centralized SIEM for cross-host analysis
How to Mitigate CVE-2026-89681
Immediate Actions Required
- Inventory Linux hosts operating as NFS servers with pNFS layouts enabled
- Apply the upstream kernel patch or vendor-provided kernel update on all affected servers
- Restrict NFS exports to trusted network segments while patching is scheduled
Patch Information
The fix is upstreamed in the Linux kernel via commits 8580571227451384399b3fa53fcde19848c48e5a and a278d361e0e8f242211891193d56483a7a9f47a8. Distribution vendors backport these commits to supported -stable branches. Install the vendor kernel package that includes both commits and reboot to load the corrected nfsd module.
Workarounds
- Disable pNFS layout types on the server if not required by clients
- Limit NFS server exposure to trusted network segments using firewall rules or /etc/exports host restrictions
- Reboot NFS servers periodically to reclaim leaked layout stateid memory until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.