CVE-2026-89686

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke

nfsd4alloclayoutstateid reads fp->fideleg_file without holding

fi_lock when the parent stateid is a delegation. A concurrent delegation

revoke via the laundromat can clear fidelegfile under fi_lock, causing

nfsdfileget() to return NULL and triggering the BUG_ON.

This race is client-reachable: two NFS clients can trigger it by having

one hold a delegation while another opens the same file to force a

recall. When the first client doesn't respond to the recall, the

laundromat revokes it. A concurrent LAYOUTGET from any client using the

delegation stateid hits the race window.

Fix this by taking filock around the fideleg_file read in the

SCTYPEDELEG path, matching the locking discipline of the

findanyfile() arm, and replacing the BUG_ON with a graceful error

return that cleans up the partially-initialized layout stateid.