{"id":21608,"date":"2026-09-12T04:31:24","date_gmt":"2026-09-11T20:31:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89686"},"modified":"2026-09-12T04:31:24","modified_gmt":"2026-09-11T20:31:24","slug":"cve-2026-89686","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89686","title":{"rendered":"CVE-2026-89686 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix BUG_ON in n"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke<\/p>\n<p>nfsd4_alloc_layout_stateid reads fp-&gt;fi_deleg_file without holding<br \/>\nfi_lock when the parent stateid is a delegation. A concurrent delegation<br \/>\nrevoke via the laundromat can clear fi_deleg_file under fi_lock, causing<br \/>\nnfsd_file_get() to return NULL and triggering the BUG_ON.<\/p>\n<p>This race is client-reachable: two NFS clients can trigger it by having<br \/>\none hold a delegation while another opens the same file to force a<br \/>\nrecall. When the first client doesn&#8217;t respond to the recall, the<br \/>\nlaundromat revokes it. A concurrent LAYOUTGET from any client using the<br \/>\ndelegation stateid hits the race window.<\/p>\n<p>Fix this by taking fi_lock around the fi_deleg_file read in the<br \/>\nSC_TYPE_DELEG path, matching the locking discipline of the<br \/>\nfind_any_file() arm, and replacing the BUG_ON with a graceful error<br \/>\nreturn that cleans up the partially-initialized layout stateid.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke<\/p>\n<p>nfsd4_alloc_layout_stateid reads fp-&gt;fi_deleg_file with<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21608","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}