CVE-2026-89692: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89692 Overview

CVE-2026-89692 is a logic flaw in the Linux kernel NFS server (nfsd) delegation recall path. The function nfsd_break_one_deleg() sets the NFSD4_CALLBACK_RUNNING bit before queuing recall work via nfsd4_run_cb(). When the queue attempt fails, the code drops the refcount but never clears the running bit. The bit becomes a permanent latch on dp->dl_recall.cb_flags, causing every subsequent break_lease() on the same delegation to hit the early-return guard and silently skip the recall. Conflicting opens or file locks then stall indefinitely, producing a network-reachable denial-of-service condition against NFSv4 exports.

Critical Impact
A remote NFSv4 client can trigger a persistent stall of file lock and open operations on affected exports without authentication.

Affected Products

Linux kernel (upstream) NFS server (nfsd) subsystem
Distributions shipping vulnerable stable kernel branches referenced by the fix commits
Systems exposing NFSv4 exports with delegation support enabled

Discovery Timeline

2026-09-11 - CVE-2026-89692 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89692

Vulnerability Analysis

The defect lives in nfsd_break_one_deleg() within the NFSv4 delegation recall workflow. The function serializes concurrent recall attempts by calling test_and_set_bit(NFSD4_CALLBACK_RUNNING, ...) on entry. It then bumps a refcount and invokes nfsd4_run_cb() to queue the callback work item. The only code path that clears NFSD4_CALLBACK_RUNNING is nfsd41_destroy_cb() in fs/nfsd/nfs4callback.c, which executes from the workqueue itself.

When nfsd4_run_cb() fails to queue the work, the cleanup path decrements the refcount but leaves the running bit set. Because the workqueue never runs, nfsd41_destroy_cb() is unreachable, and no other site clears the flag. The delegation's cb_flags field remains latched in the RUNNING state permanently.

All subsequent break_lease() calls against that delegation short-circuit at the test_and_set_bit guard. The recall is silently suppressed, the delegation is never returned by the client, and any conflicting open or fcntl lock request from another client blocks until manual intervention. The result is a network-reachable availability failure against exports that hand out delegations.

Root Cause

The root cause is an incomplete error-handling path — a state-machine desynchronization between the RUNNING flag and the queued work item. The fix, published in commits b036727d334b, b137930ee52e, and cb2d0c4d1b3d, clears NFSD4_CALLBACK_RUNNING on the !queued branch alongside the existing refcount_dec. This restores the invariant that the bit is set only while a callback is actually pending or in flight.

Attack Vector

Exploitation requires reaching the NFSv4 service over the network and inducing a failed callback queue. An unauthenticated remote client that can open files on an export capable of issuing delegations can trigger the recall path. Any condition that causes nfsd4_run_cb() to fail — for example, workqueue or allocation pressure — leaves the delegation in the latched state. Subsequent legitimate clients requesting conflicting access then hang. The vulnerability does not permit code execution, disclosure, or integrity impact; the outcome is a persistent hang of lock and open operations on the affected file.

No verified public exploit code is available. See the Linux Kernel Commit Log for the authoritative patch context.

Detection Methods for CVE-2026-89692

Indicators of Compromise

NFSv4 client open or lock requests that hang indefinitely against a specific file while the server remains otherwise responsive.
nfsd threads observed waiting on lease-break completions with no corresponding CB_RECALL traffic on the wire.
Delegation state entries whose cb_flags show NFSD4_CALLBACK_RUNNING set with no active workqueue item.

Detection Strategies

Packet capture on port 2049 showing absence of CB_RECALL operations when conflicting opens occur on delegated files.
Kernel tracing with trace-cmd or bpftrace on nfsd_break_one_deleg and nfsd4_run_cb return paths to catch failed queue attempts.
Correlate workqueue allocation failures in dmesg with elevated NFS client-side timeouts.

Monitoring Recommendations

Track running kernel versions against the fix commits b036727d334b, b137930ee52e, and cb2d0c4d1b3d across the fleet.
Alert on sustained NFSv4 operation latency spikes and on nfsd kernel threads stuck in D state.
Monitor client-side NFS statistics for repeated OPEN or LOCK retries against the same file handles.

How to Mitigate CVE-2026-89692

Immediate Actions Required

Apply the upstream stable kernel updates containing commits b036727d334b, b137930ee52e, or cb2d0c4d1b3d as delivered by your distribution.
Inventory hosts running NFSv4 servers with delegations enabled and prioritize patching those exposed beyond trusted management networks.
Restart affected nfsd instances after patching to clear any delegations already in the latched state.

Patch Information

The fix clears NFSD4_CALLBACK_RUNNING on the failed-queue branch of nfsd_break_one_deleg(), alongside the existing refcount_dec. Vendor-neutral references: Linux Kernel Commit b036727d, Linux Kernel Commit b137930e, and Linux Kernel Commit cb2d0c4d. Consume the fix through your distribution's stable kernel update channel.

Workarounds

Disable NFSv4 delegations on the server by setting /proc/sys/fs/leases-enable to 0 before starting nfsd, accepting the associated performance trade-off.
Restrict NFS service exposure to trusted network segments using host firewalls or network ACLs until patches are deployed.
Restart the nfs-server service to recover file access when a delegation enters the latched state on an unpatched host.

bash

# Configuration example
# Temporarily disable NFSv4 leases/delegations until patched
echo 0 > /proc/sys/fs/leases-enable
systemctl restart nfs-server

# Verify the running kernel includes the fix commit
uname -r