CVE-2026-89681 - Vulnerability Details

- nfsd: fix layout fence worker double-reference race

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix layout fence worker double-reference race

The workqueue core clears WORK_STRUCT_PENDING before the callback
is invoked, so delayed_work_pending() in lm_breaker_timedout() can
return false while the fence worker is already running. This lets
the breaker take a duplicate sc_count reference and schedule a new
worker that coalesces with the in-progress one. The extra reference
is never put, leaking the layout stateid.

Replace the racy delayed_work_pending() check with an
ls_fence_inflight boolean set atomically with
refcount_inc_not_zero() under ls_lock, and cleared under ls_lock
before the final nfs4_put_stid() on the dispose path; the retry
path intentionally retains it. Remove the self-rearm
mod_delayed_work() at the top of the worker.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in the Linux kernel’s NFS daemon layout fence worker. It allows the breaker to duplicate a reference to a layout state identifier that is never released. This creates a reference‑counting leak, causing the layout stateid to persist beyond its intended lifetime.

Affected Systems

All configurations that use the Linux kernel and its NFS daemon are potentially impacted because the fault exists in kernel workqueue code used by NFS. The specific kernel version range is not enumerated, so any kernel build without the patch is at risk.

Risk and Exploitability

The CVSS score of 9.8 categorizes the flaw as critical, and the EPSS score of < 1% indicates a low probability of real‑world exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. An attacker who can send NFS requests that trigger the race may obtain an unreleased reference, potentially increasing kernel resource usage. The available information does not describe direct denial‑of‑service or code execution capabilities.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f52792f484ba2316853736856dde19b7e7458861`	affected	< a278d361e0e8f242211891193d56483a7a9f47a8
`f52792f484ba2316853736856dde19b7e7458861`	affected	< 8580571227451384399b3fa53fcde19848c48e5a

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f52792f484ba2316853736856dde19b7e7458861,a278d361e0e8f242211891193d56483a7a9f47a8)`	affected	code_commit	—
`[f52792f484ba2316853736856dde19b7e7458861,8580571227451384399b3fa53fcde19848c48e5a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to the latest Linux kernel that contains the NFSd layout fence worker fix.
If a kernel upgrade cannot be implemented immediately, limit NFS accessibility to trusted sources or temporarily stop NFS services to reduce exposure.
Review kernel logs for indications of repeated fence worker activity or unexpected stateid references to detect possible exploitation.

Generated by OpenCVE AI on September 15, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00553.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a
https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8
https://nvd.nist.gov/vuln/detail/CVE-2026-89681
https://www.cve.org/CVERecord?id=CVE-2026-89681

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-401

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89681 https://www.cve.org/CVERecord?id=CVE-2026-89681
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 12 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-401

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid. Replace the racy delayed_work_pending() check with an ls_fence_inflight boolean set atomically with refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod_delayed_work() at the top of the worker.
Title		nfsd: fix layout fence worker double-reference race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:04.121Z

Updated: 2026-09-13T06:33:04.863Z

Reserved: 2026-09-11T19:38:34.748Z

Link: CVE-2026-89681

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:54.917

Modified: 2026-09-13T07:17:33.890

Link: CVE-2026-89681

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:04Z

Links: CVE-2026-89681 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:30:10Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object