---
id: CVE-2026-23050
title: 'pNFS: Fix a deadlock when returning a delegation during open()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pNFS: Fix a deadlock when returning a delegation during open()

  Ben Coddington reports seeing a hang in the following stack trace:
    0 [ffffd0b50e1774e0] __schedule at …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 <
    05a685b38dbca489d5f21eac9e7f20959344076a
  - >-
    Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 <
    c57387d447a2bcbaea009ba5f9497adf3de5edeb
  - >-
    Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 <
    a316fd9d3065b753b03d802530004aea481512cc
  - >-
    Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 <
    d6c75aa9d607044d1e5c8498eff0259eed356c32
  - >-
    Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 <
    857bf9056291a16785ae3be1d291026b2437fc48
  - Linux 4.10
published: '2026-02-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:23:41.926Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23050'
references:
  - url: 'https://git.kernel.org/stable/c/05a685b38dbca489d5f21eac9e7f20959344076a'
  - url: 'https://git.kernel.org/stable/c/c57387d447a2bcbaea009ba5f9497adf3de5edeb'
  - url: 'https://git.kernel.org/stable/c/a316fd9d3065b753b03d802530004aea481512cc'
  - url: 'https://git.kernel.org/stable/c/d6c75aa9d607044d1e5c8498eff0259eed356c32'
  - url: 'https://git.kernel.org/stable/c/857bf9056291a16785ae3be1d291026b2437fc48'
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.10064
ingestedAt: '2026-11-05T15:02:32.185Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pNFS: Fix a deadlock when returning a delegation during open()

Ben Coddington reports seeing a hang in the following stack trace:
  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415
  1 [ffffd0b50e177548] schedule at ffffffff9ca05717
  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1
  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb
  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5
  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]
  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]
  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]
  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]
  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]
 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]
 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]
 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]
 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]
 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]
 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]
 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]
 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea
 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e
 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935

The issue is that the delegreturn is being asked to wait for a layout
return that cannot complete because a state recovery was initiated. The
state recovery cannot complete until the open() finishes processing the
delegations it was given.

The solution is to propagate the existing flags that indicate a
non-blocking call to the function pnfs_roc(), so that it knows not to
wait in this situation.

## Affected

- `Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 < 05a685b38dbca489d5f21eac9e7f20959344076a`
- `Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 < c57387d447a2bcbaea009ba5f9497adf3de5edeb`
- `Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 < a316fd9d3065b753b03d802530004aea481512cc`
- `Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 < d6c75aa9d607044d1e5c8498eff0259eed356c32`
- `Linux >= 29ade5db12930ec60133f6a02791f4b1a4af2943 < 857bf9056291a16785ae3be1d291026b2437fc48`
- `Linux 4.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.