CVE-2026-89686

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding

fi_lock when the parent stateid is a delegation. A concurrent delegation

revoke via the laundromat can clear fi_deleg_file under fi_lock, causing

nfsd_file_get() to return NULL and triggering the BUG_ON.

This race is client-reachable: two NFS clients can trigger it by having

one hold a delegation while another opens the same file to force a

recall. When the first client doesn't respond to the recall, the

laundromat revokes it. A concurrent LAYOUTGET from any client using the

delegation stateid hits the race window.

Fix this by taking fi_lock around the fi_deleg_file read in the

SC_TYPE_DELEG path, matching the locking discipline of the

find_any_file() arm, and replacing the BUG_ON with a graceful error

return that cleans up the partially-initialized layout stateid.