CVE-2026-89681
A race condition in the Linux kernel’s NFS server can cause a layout state ID to leak, potentially leading to resource exhaustion or crashes. The issue has been fixed in a kernel update that removes the double-reference bug in the layout fence worker. Users should update to a kernel version that includes this patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server components, especially systems running NFSv4 that rely on layout state IDs.
Real-world impact
An attacker could trigger the race to leak state IDs, causing the NFS server to consume excessive memory or crash, resulting in a denial‑of‑service for clients.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network without authentication, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Update the Linux kernel to a version that includes the nfsd layout fence worker double-reference race fix.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 6h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.