Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid. Replace the racy delayed_work_pending() check with an ls_fence_inflight boolean set atomically with refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod_delayed_work() at the top of the worker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:54.917Z",
  "pubdate": "2026-09-11T20:19:54.917Z",
  "executiveSummary": "This vulnerability involves a race condition within the Linux kernel's nfsd subsystem related to the layout fence worker mechanism.\nThe flaw allows for a double-reference leak of the layout stateid, leading to memory exhaustion or potential system instability.\nThe issue stems from an unreliable check using delayed_work_pending(), which fails to accurately detect if the fence worker is already in progress, as the WORK_STRUCT_PENDING flag is cleared before the callback executes.\nSuccessful exploitation or triggering of this condition requires an attacker to interact with the NFS server in a manner that repeatedly triggers layout fencing, leading to a permanent leakage of state objects.\nThe risk is primarily operational, where repeated exposure could lead to kernel memory pressure, though it does not explicitly allow for arbitrary code execution based on the provided data.\nThe vulnerability affects the nfsd component of the Linux kernel.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper synchronization within the nfsd layout fencing logic, specifically inside the lm_breaker_timedout() function.\nIn the Linux workqueue implementation, the WORK_STRUCT_PENDING flag is cleared immediately prior to the invocation of the worker callback. Consequently, using delayed_work_pending() to verify the status of a scheduled fence worker is inherently race-prone.\nIf the breaker logic calls delayed_work_pending() while the worker is transitioning from 'pending' to 'executing', the function may return false even though the worker is effectively active.\nThis check failure allows the breaker logic to incorrectly conclude that no fence worker is running. Consequently, it executes a redundant refcount_inc() on the layout stateid (sc_count) and schedules a new worker instance that coalesces with the one already in progress.\nBecause the logic fails to track the lifecycle of the worker accurately, the extra reference taken by the breaker is never released (a 'leak'). Over time, this leads to an accumulation of orphaned layout state objects that cannot be freed by the system.\nThe fix replaces the unreliable delayed_work_pending() check with a more robust state tracking mechanism using an atomic ls_fence_inflight boolean. By wrapping the state transition (incrementing the reference count and setting the flag) within the ls_lock mutex, the kernel ensures mutual exclusion.\nThe flag is strictly managed: it is set under ls_lock upon initial invocation and cleared under the same lock prior to the final nfs4_put_stid() call in the disposal path, ensuring that the reference count accurately reflects the lifecycle of the object.\nAdditionally, the removal of the self-rearm mod_delayed_work() at the top of the worker function prevents unnecessary task resubmission, further stabilizing the state machine and preventing further race conditions.\nThis architecture shift effectively closes the race window, as the state of the fence worker is now coupled directly to the underlying object lock rather than relying on transient flags set by the kernel workqueue subsystem."
}