CVE-2026-89692

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit

at entry to serialize recall work, then calls nfsd4_run_cb() to queue

the recall. When the queue attempt fails the refcount bump is undone,

but the RUNNING bit is left set. The only site that clears the bit is

nfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the

workqueue and is therefore unreachable when nothing was queued.

The bit becomes a permanent latch on dp->dl_recall.cb_flags: every

subsequent break_lease() on the same delegation hits the early-return

guard in nfsd_break_one_deleg() and silently skips the recall, so the

delegation is never broken and the conflicting open or lock stalls.

Fix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside

the refcount_dec.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References