CVE-2026-89686: Linux Kernel Race Condition Vulnerability

CVE-2026-89686 Overview

CVE-2026-89686 is a race condition vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the nfsd4_alloc_layout_stateid function, which reads fp->fi_deleg_file without holding the fi_lock when the parent stateid is a delegation. A concurrent delegation revoke through the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering a BUG_ON kernel assertion. The race is client-reachable across the network without authentication, enabling remote attackers to trigger kernel-level failures on NFSv4.1+ servers exporting pNFS layouts.

Critical Impact
Remote unauthenticated NFS clients can trigger a kernel BUG_ON, resulting in denial of service and potential memory corruption in the NFS server.

Affected Products

Linux kernel versions containing the vulnerable nfsd4_alloc_layout_stateid code path
NFS servers configured with pNFS layout support (NFSv4.1+)
Linux distributions shipping the affected nfsd module

Discovery Timeline

2026-09-11 - CVE-2026-89686 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89686

Vulnerability Analysis

The vulnerability exists in the nfsd4_alloc_layout_stateid function within the Linux kernel's NFS server implementation. When allocating a layout stateid whose parent is a delegation (SC_TYPE_DELEG), the function accesses fp->fi_deleg_file without acquiring the required fi_lock spinlock. This violates the locking discipline established by the find_any_file() code path, which properly serializes access to the delegation file pointer.

A concurrent delegation revocation through the NFS laundromat can clear fi_deleg_file while holding fi_lock, creating a race window where the unprotected read observes a valid pointer that becomes NULL before nfsd_file_get() executes. When nfsd_file_get() returns NULL, the subsequent BUG_ON assertion fires, halting kernel execution on the affected code path.

Root Cause

The root cause is a missing lock acquisition on the SC_TYPE_DELEG branch of nfsd4_alloc_layout_stateid. The read of fp->fi_deleg_file must be serialized with writers that modify the field under fi_lock. The additional use of BUG_ON for an error condition that is reachable through normal protocol operation compounds the issue by converting a recoverable state into a fatal kernel assertion.

Attack Vector

Two cooperating NFS clients can reliably trigger the race. One client holds a delegation on a target file. A second client opens the same file, forcing the server to issue a delegation recall. When the delegation holder fails to respond, the laundromat revokes the delegation and clears fi_deleg_file. A concurrent LAYOUTGET operation from any client using the delegation stateid hits the unlocked read and triggers the assertion. The attack requires only network access to the NFS service and standard NFSv4.1+ protocol operations.

No verified proof-of-concept code is publicly available. Refer to the upstream commits for exact patch details: Kernel Git Commit 607a56f, Kernel Git Commit 97bda8b, Kernel Git Commit c517f27, and Kernel Git Commit ca94ba3.

Detection Methods for CVE-2026-89686

Indicators of Compromise

Kernel panic or BUG_ON messages referencing nfsd4_alloc_layout_stateid in dmesg or /var/log/kern.log
Unexpected NFS server crashes correlated with concurrent LAYOUTGET and delegation recall activity
Repeated delegation recall failures followed by laundromat revocation events in NFS server logs

Detection Strategies

Monitor kernel ring buffer output for stack traces originating in nfsd4_alloc_layout_stateid or nfsd_file_get
Correlate NFS delegation revoke events with LAYOUTGET requests arriving within short time windows from distinct clients
Baseline expected NFS client behavior and alert on clients that consistently fail to honor delegation recalls

Monitoring Recommendations

Ingest kernel logs from NFS servers into a centralized log analytics platform for pattern detection
Track NFS server availability metrics and alert on unplanned reboots or service restarts
Enable NFSv4 protocol tracing during suspected incidents to capture the stateid values involved in the race

How to Mitigate CVE-2026-89686

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor builds are available
Restrict NFS server exposure to trusted network segments using firewall rules and VPN gateways
Audit NFS client inventory and remove or isolate clients that behave abnormally with delegations

Patch Information

The fix takes fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm. The patch also replaces the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid. The corrective changes are available in commits 607a56f, 97bda8b, c517f27, and ca94ba3. Consult your Linux distribution vendor for backported kernel packages.

Workarounds

Disable pNFS layout support on exported filesystems if not required by clients
Export filesystems without NFSv4 delegations enabled by tuning /proc/sys/fs/leases-enable or equivalent server-side controls
Reduce delegation lease times to shrink the race window until patches are deployed

bash

# Disable file leases at runtime to prevent NFS delegations
echo 0 > /proc/sys/fs/leases-enable

# Restrict NFS service exposure with host-based firewall
iptables -A INPUT -p tcp --dport 2049 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP