CVE-2026-89681

nfsd: fix layout fence worker double-reference race

Published Sep 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix layout fence worker double-reference race

The workqueue core clears WORK_STRUCT_PENDING before the callback
is invoked, so delayed_work_pending() in lm_breaker_timedout() can
return false while the fence worker is already running. This lets
the breaker take a duplicate sc_count reference and schedule a new
worker that coalesces with the in-progress one. The extra reference
is never put, leaking the layout stateid.

Replace the racy delayed_work_pending() check with an
ls_fence_inflight boolean set atomically with
refcount_inc_not_zero() under ls_lock, and cleared under ls_lock
before the final nfs4_put_stid() on the dispose path; the retry
path intentionally retains it. Remove the self-rearm
mod_delayed_work() at the top of the worker.

Analysis

Technical impact

The vulnerability is a race condition in the Linux kernel’s NFS daemon layout fence worker. It allows the breaker to duplicate a reference to a layout state identifier that is never released. This creates a reference‑counting leak, causing the layout stateid to persist beyond its intended lifetime.

Affected Systems

All configurations that use the Linux kernel and its NFS daemon are potentially impacted because the fault exists in kernel workqueue code used by NFS. The specific kernel version range is not enumerated, so any kernel build without the patch is at risk.

Risk and Exploitability

The CVSS score of 9.8 categorizes the flaw as critical, and the EPSS score of < 1% indicates a low probability of real‑world exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. An attacker who can send NFS requests that trigger the race may obtain an unreleased reference, potentially increasing kernel resource usage. The available information does not describe direct denial‑of‑service or code execution capabilities.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f52792f484ba2316853736856dde19b7e7458861`	affected	< a278d361e0e8f242211891193d56483a7a9f47a8
`f52792f484ba2316853736856dde19b7e7458861`	affected	< 8580571227451384399b3fa53fcde19848c48e5a

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[f52792f484ba2316853736856dde19b7e7458861,a278d361e0e8f242211891193d56483a7a9f47a8)`	affected	code_commit	—
`[f52792f484ba2316853736856dde19b7e7458861,8580571227451384399b3fa53fcde19848c48e5a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to the latest Linux kernel that contains the NFSd layout fence worker fix.
If a kernel upgrade cannot be implemented immediately, limit NFS accessibility to trusted sources or temporarily stop NFS services to reduce exposure.
Review kernel logs for indications of repeated fence worker activity or unexpected stateid references to detect possible exploitation.

Generated by OpenCVE AI on September 15, 2026 at 20:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.553% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a
https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8
https://nvd.nist.gov/vuln/detail/CVE-2026-89681
https://www.cve.org/CVERecord?id=CVE-2026-89681

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 6:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-401

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89681 https://www.cve.org/CVERecord?id=CVE-2026-89681
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 7:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-401

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid. Replace the racy delayed_work_pending() check with an ls_fence_inflight boolean set atomically with refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod_delayed_work() at the top of the worker.
Title		nfsd: fix layout fence worker double-reference race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/8580571227451384399b3fa53fcde19848c48e5a https://git.kernel.org/stable/c/a278d361e0e8f242211891193d56483a7a9f47a8