GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89681 (GCVE-0-2026-89681)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: fix layout fence worker double-reference race
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid. Replace the racy delayed_work_pending() check with an ls_fence_inflight boolean set atomically with refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod_delayed_work() at the top of the worker.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f52792f484ba2316853736856dde19b7e7458861 , < a278d361e0e8f242211891193d56483a7a9f47a8 (git)
Affected: f52792f484ba2316853736856dde19b7e7458861 , < 8580571227451384399b3fa53fcde19848c48e5a (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a278d361e0e8f242211891193d56483a7a9f47a8",
              "status": "affected",
              "version": "f52792f484ba2316853736856dde19b7e7458861",
              "versionType": "git"
            },
            {
              "lessThan": "8580571227451384399b3fa53fcde19848c48e5a",
              "status": "affected",
              "version": "f52792f484ba2316853736856dde19b7e7458861",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix layout fence worker double-reference race\n\nThe workqueue core clears WORK_STRUCT_PENDING before the callback\nis invoked, so delayed_work_pending() in lm_breaker_timedout() can\nreturn false while the fence worker is already running. This lets\nthe breaker take a duplicate sc_count reference and schedule a new\nworker that coalesces with the in-progress one. The extra reference\nis never put, leaking the layout stateid.\n\nReplace the racy delayed_work_pending() check with an\nls_fence_inflight boolean set atomically with\nrefcount_inc_not_zero() under ls_lock, and cleared under ls_lock\nbefore the final nfs4_put_stid() on the dispose path; the retry\npath intentionally retains it.  Remove the self-rearm\nmod_delayed_work() at the top of the worker."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd pNFS SCSI layout fencing (nfsd4_layout_lm_breaker_timedout \u2192 nfsd4_layout_fence_worker in fs/nfsd/nfs4layouts.c), reached over NFSv4.1 COMPOUND on TCP/2049: LAYOUTGET installs an FL_LAYOUT lease, then a conflicting OPEN/WRITE hits nfsd_open_break_lease \u2192 time_out_leases after recall timeout.\nAC:L - The attacker controls both sides of the delayed_work_pending race: one client holds a SCSI layout and ignores CB_LAYOUTRECALL so the fence worker runs, while other attacker connections spam OPEN/WRITE so concurrent nfsd threads call lm_breaker_timedout while WORK_STRUCT_PENDING is already clear; the sequence is retryable.\nPR:N - Typical nfsd exports accept AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication; EXCHANGE_ID, CREATE_SESSION, OPEN, and LAYOUTGET succeed for any host permitted by the export, so a remote NFSv4.1 client needs no kernel-verified credentials or local account on the server.\nUI:N - The attacker is the NFS client and sends LAYOUTGET plus conflicting OPEN/WRITE compounds against an already-running pNFS SCSI export; no victim user must mount a filesystem, open a file, or take any other action on the host.\nS:U - Impact is kernel nfsd layout-stateid and nfs4_client lifetime on the NFS server host and does not cross a VM, hypervisor, sandbox, or IOMMU security boundary.\nC:H - The unmatched sc_count leaves the nfs4_layout_stateid on nfs4_file.fi_lo_states without pinning nfs4_client; after that client is expired, a later LAYOUTGET walks the list and nfsd4_run_cb dereferences freed cb_clp, a use-after-free that can be reused for arbitrary kernel reads.\nI:H - The same use-after-free of nfs4_client (cl_cb_session, cl_callback_wq, and nfsd4_callback_ops) from nfsd4_recall_file_layout \u2192 nfsd4_run_cb enables heap spraying and function-pointer hijack of the CB_LAYOUTRECALL work path.\nA:H - Each won race permanently leaks a layout stateid (and can pin nfs4_client via cl_lo_states); repeating LAYOUTGET/fence races exhausts nfsd state and kernel memory, and the later nfs4_client use-after-free oopses or panics the nfsd thread."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:04.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a"
        }
      ],
      "title": "nfsd: fix layout fence worker double-reference race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89681",
    "datePublished": "2026-09-11T19:46:04.121Z",
    "dateReserved": "2026-09-11T19:38:34.748Z",
    "dateUpdated": "2026-09-13T06:33:04.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89681",
      "date": "2026-09-16",
      "epss": "0.00379",
      "percentile": "0.31593"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89681\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:54.917\",\"lastModified\":\"2026-09-13T07:17:33.890\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix layout fence worker double-reference race\\n\\nThe workqueue core clears WORK_STRUCT_PENDING before the callback\\nis invoked, so delayed_work_pending() in lm_breaker_timedout() can\\nreturn false while the fence worker is already running. This lets\\nthe breaker take a duplicate sc_count reference and schedule a new\\nworker that coalesces with the in-progress one. The extra reference\\nis never put, leaking the layout stateid.\\n\\nReplace the racy delayed_work_pending() check with an\\nls_fence_inflight boolean set atomically with\\nrefcount_inc_not_zero() under ls_lock, and cleared under ls_lock\\nbefore the final nfs4_put_stid() on the dispose path; the retry\\npath intentionally retains it.  Remove the self-rearm\\nmod_delayed_work() at the top of the worker.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4layouts.c\",\"fs/nfsd/state.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f52792f484ba2316853736856dde19b7e7458861\",\"lessThan\":\"a278d361e0e8f242211891193d56483a7a9f47a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f52792f484ba2316853736856dde19b7e7458861\",\"lessThan\":\"8580571227451384399b3fa53fcde19848c48e5a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4layouts.c\",\"fs/nfsd/state.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T07:00:37+00:00",
      "cve": "CVE-2026-89681",
      "id": "CVE-2026-89681",
      "initial_release_date": "2026-09-11T19:46:04.121000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: nfsd double-reference race leads to memory leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89681.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:22Z",
      "cve": "CVE-2026-89681",
      "id": "CVE-2026-89681",
      "initial_release_date": "2026-09-15T00:57:13Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89681",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89681.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.