---
id: CVE-2026-89686
title: 'nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

  nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding
  fi_lock when the parent s…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-416
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d <
    d12af460df27876661707efab3a8532146cb961f
  - >-
    Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d <
    c517f27498757e616d2a8fe6d16caad1fee422e6
  - >-
    Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d <
    607a56fea772c1f4f4989d8e255dd4f7192d9604
  - >-
    Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d <
    97bda8b4284d90897a1f1922e5082ff9e35d7c7e
  - >-
    Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d <
    ca94ba36172046be6a694a7986f6931e47ed4d51
  - Linux 4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:26:03.140311Z'
published: '2026-09-11'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:48:21.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89686'
references:
  - url: 'https://git.kernel.org/stable/c/d12af460df27876661707efab3a8532146cb961f'
  - url: 'https://git.kernel.org/stable/c/c517f27498757e616d2a8fe6d16caad1fee422e6'
  - url: 'https://git.kernel.org/stable/c/607a56fea772c1f4f4989d8e255dd4f7192d9604'
  - url: 'https://git.kernel.org/stable/c/97bda8b4284d90897a1f1922e5082ff9e35d7c7e'
  - url: 'https://git.kernel.org/stable/c/ca94ba36172046be6a694a7986f6931e47ed4d51'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89686.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89686'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532098'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89686'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89686'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89686.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-89686'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00663
epssPercentile: 0.51482
scores:
  cna: 9.8
  vendor: 5.3
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding
fi_lock when the parent stateid is a delegation. A concurrent delegation
revoke via the laundromat can clear fi_deleg_file under fi_lock, causing
nfsd_file_get() to return NULL and triggering the BUG_ON.

This race is client-reachable: two NFS clients can trigger it by having
one hold a delegation while another opens the same file to force a
recall. When the first client doesn't respond to the recall, the
laundromat revokes it. A concurrent LAYOUTGET from any client using the
delegation stateid hits the race window.

Fix this by taking fi_lock around the fi_deleg_file read in the
SC_TYPE_DELEG path, matching the locking discipline of the
find_any_file() arm, and replacing the BUG_ON with a graceful error
return that cleans up the partially-initialized layout stateid.

## Affected

- `Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < d12af460df27876661707efab3a8532146cb961f`
- `Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < c517f27498757e616d2a8fe6d16caad1fee422e6`
- `Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 607a56fea772c1f4f4989d8e255dd4f7192d9604`
- `Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 97bda8b4284d90897a1f1922e5082ff9e35d7c7e`
- `Linux >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < ca94ba36172046be6a694a7986f6931e47ed4d51`
- `Linux 4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89686.json)