CVE-2026-89681

Status: UPDATED  |  Advisory ID: CVE-2026-89681

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix layout fence worker double-reference race

The workqueue core clears WORK_STRUCT_PENDING before the callback

is invoked, so delayed_work_pending() in lm_breaker_timedout() can

return false while the fence worker is already running. This lets

the breaker take a duplicate sc_count reference and schedule a new

worker that coalesces with the in-progress one. The extra reference

is never put, leaking the layout stateid.

Replace the racy delayed_work_pending() check with an

ls_fence_inflight boolean set atomically with

refcount_inc_not_zero() under ls_lock, and cleared under ls_lock

before the final nfs4_put_stid() on the dispose path; the retry

path intentionally retains it. Remove the self-rearm

mod_delayed_work() at the top of the worker. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References