GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89692 (GCVE-0-2026-89692)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit at entry to serialize recall work, then calls nfsd4_run_cb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that clears the bit is nfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the workqueue and is therefore unreachable when nothing was queued. The bit becomes a permanent latch on dp->dl_recall.cb_flags: every subsequent break_lease() on the same delegation hits the early-return guard in nfsd_break_one_deleg() and silently skips the recall, so the delegation is never broken and the conflicting open or lock stalls. Fix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside the refcount_dec.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1054e8ffc5c492f341bdf1888b882f1d163dd3d8 , < b137930ee52e3ef38915a3511d4c070463b63a32 (git)
Affected: 1054e8ffc5c492f341bdf1888b882f1d163dd3d8 , < cb2d0c4d1b3d301d042ed61365eaa8cb0141a254 (git)
Affected: 1054e8ffc5c492f341bdf1888b882f1d163dd3d8 , < b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b137930ee52e3ef38915a3511d4c070463b63a32",
              "status": "affected",
              "version": "1054e8ffc5c492f341bdf1888b882f1d163dd3d8",
              "versionType": "git"
            },
            {
              "lessThan": "cb2d0c4d1b3d301d042ed61365eaa8cb0141a254",
              "status": "affected",
              "version": "1054e8ffc5c492f341bdf1888b882f1d163dd3d8",
              "versionType": "git"
            },
            {
              "lessThan": "b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96",
              "status": "affected",
              "version": "1054e8ffc5c492f341bdf1888b882f1d163dd3d8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clear CALLBACK_RUNNING on failed delegation recall queue\n\nnfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit\nat entry to serialize recall work, then calls nfsd4_run_cb() to queue\nthe recall.  When the queue attempt fails the refcount bump is undone,\nbut the RUNNING bit is left set.  The only site that clears the bit is\nnfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the\nworkqueue and is therefore unreachable when nothing was queued.\n\nThe bit becomes a permanent latch on dp-\u003edl_recall.cb_flags: every\nsubsequent break_lease() on the same delegation hits the early-return\nguard in nfsd_break_one_deleg() and silently skips the recall, so the\ndelegation is never broken and the conflicting open or lock stalls.\n\nFix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside\nthe refcount_dec."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_break_one_deleg() runs in in-kernel nfsd (fs/nfsd/nfs4state.c) and is reached over TCP/2049 via svc_process to nfsd_dispatch to nfsd4_proc_compound: a remote NFSv4 OPEN grants a delegation, then a conflicting OPEN hits nfsd_file_acquire/nfsd_open_break_lease to __break_lease to nfsd_break_deleg_cb().\nAC:L - The attacker drives both sides with two NFSv4 clients: one holds the delegation while the other sends conflicting OPEN/LOCK/SETATTR to invoke nfsd_break_one_deleg(), and can DESTROY_CLIENTID or flap the backchannel so queue_work() fails; the sequence is retryable and needs no uninfluenced memory layout.\nPR:N - Default AUTH_SYS/AUTH_NULL nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can EXCHANGE_ID/SETCLIENTID, OPEN to receive a delegation, and issue a conflicting OPEN with no local Linux account or capability.\nUI:N - The attacking NFS clients send the OPEN, conflicting OPEN, and optional DESTROY_CLIENTID RPCs themselves; no victim user on the NFS server must mount a filesystem, open a file, or otherwise interact at attack time.\nS:U - The latched NFSD4_CALLBACK_RUNNING bit and stalled lease-break live in kernel nfsd/VFS state on the NFS server; this is not a VM, IOMMU, or sandbox boundary crossing.\nC:N - The bug only leaves NFSD4_CALLBACK_RUNNING set so later recalls are skipped; it does not read attacker-inaccessible kernel memory, leak pointers, or return extra data to the client.\nI:N - There is no use-after-free, out-of-bounds write, or other memory corruption, and conflicting writers are blocked rather than committing unauthorized file changes, so integrity is unaffected.\nA:H - When nfsd4_run_cb() fails, RUNNING stays set, later break_lease() skips CB_RECALL, nfsd4_cb_recall_prepare never queues the delegation on del_recall_lru, and fl_break_time is zeroed so VFS will not expire the lease; conflicting opens/locks then stall or retry NFS4ERR_JUKEBOX indefinitely, denying the file and NFS service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:17.329Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b137930ee52e3ef38915a3511d4c070463b63a32"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb2d0c4d1b3d301d042ed61365eaa8cb0141a254"
        },
        {
          "url": "https://git.kernel.org/stable/c/b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96"
        }
      ],
      "title": "nfsd: clear CALLBACK_RUNNING on failed delegation recall queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89692",
    "datePublished": "2026-09-11T19:46:12.040Z",
    "dateReserved": "2026-09-11T19:38:34.749Z",
    "dateUpdated": "2026-09-13T06:33:17.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89692",
      "date": "2026-09-16",
      "epss": "0.00432",
      "percentile": "0.3673"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89692\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:56.260\",\"lastModified\":\"2026-09-13T07:17:35.107\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: clear CALLBACK_RUNNING on failed delegation recall queue\\n\\nnfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit\\nat entry to serialize recall work, then calls nfsd4_run_cb() to queue\\nthe recall.  When the queue attempt fails the refcount bump is undone,\\nbut the RUNNING bit is left set.  The only site that clears the bit is\\nnfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the\\nworkqueue and is therefore unreachable when nothing was queued.\\n\\nThe bit becomes a permanent latch on dp-\u003edl_recall.cb_flags: every\\nsubsequent break_lease() on the same delegation hits the early-return\\nguard in nfsd_break_one_deleg() and silently skips the recall, so the\\ndelegation is never broken and the conflicting open or lock stalls.\\n\\nFix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside\\nthe refcount_dec.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1054e8ffc5c492f341bdf1888b882f1d163dd3d8\",\"lessThan\":\"b137930ee52e3ef38915a3511d4c070463b63a32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054e8ffc5c492f341bdf1888b882f1d163dd3d8\",\"lessThan\":\"cb2d0c4d1b3d301d042ed61365eaa8cb0141a254\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054e8ffc5c492f341bdf1888b882f1d163dd3d8\",\"lessThan\":\"b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b137930ee52e3ef38915a3511d4c070463b63a32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb2d0c4d1b3d301d042ed61365eaa8cb0141a254\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T14:05:57+00:00",
      "cve": "CVE-2026-89692",
      "id": "CVE-2026-89692",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "91",
      "product_status:known_not_affected": "185",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89692.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:07Z",
      "cve": "CVE-2026-89692",
      "id": "CVE-2026-89692",
      "initial_release_date": "2026-09-12T16:23:38Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89692",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89692.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.