# CVE-2026-89692

## Summary

- **CVE ID:** CVE-2026-89692
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then calls nfsd4_run_cb() to queue
the recall.  When the queue attempt fails the refcount bump is undone,
but the RUNNING bit is left set.  The only site that clears the bit is
nfsd41_destroy_cb() (fs/nfsd/nfs4callback.c), which runs from the
workqueue and is therefore unreachable when nothing was queued.

The bit becomes a permanent latch on dp->dl_recall.cb_flags: every
subsequent break_lease() on the same delegation hits the early-return
guard in nfsd_break_one_deleg() and silently skips the recall, so the
delegation is never broken and the conflicting open or lock stalls.

Fix by clearing NFSD4_CALLBACK_RUNNING on the !queued branch alongside
the refcount_dec.

## Affected Products

- Linux — Linux (1054e8ffc5c492f341bdf1888b882f1d163dd3d8)
- Linux — Linux (6.15)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/b137930ee52e3ef38915a3511d4c070463b63a32)
- [CNA](https://git.kernel.org/stable/c/cb2d0c4d1b3d301d042ed61365eaa8cb0141a254)
- [CNA](https://git.kernel.org/stable/c/b036727d334b1b7cd4c1f1fba3b59ba93a6bbe96)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.43%
- **EPSS Percentile:** 36.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._