CVE-2026-90234 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
NFS: Return a delegation the client fails to record
When an NFS server grants a delegation in an OPEN reply, nfs_inode_set_delegation() records it on the client. However, three of its error flows return without sending DELEGRETURN.
A delegation can be relinquished only by DELEGRETURN (RFC 8881 Section 20.2.4), so dropping one silently leaves the server believing the client still holds it. If the server happens to recall that delegation, the client answers CB_RECALL with NFS4ERR_BADHANDLE because it has no record of the stateid. The server revokes the delegation and moves it onto its cl_revoked list, because the client never sends the FREE_STATEID that would drain it. Every subsequent SEQUENCE reply then carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED, and the client's state manager loops issuing TEST_STATEID across its delegations without ever clearing the condition.
The window is easy to reach now that a server offers a write delegation on any write OPEN: a delegation recalled for one opener races a re-open that the server answers with a fresh write delegation.
Instead of dropping it, hand the delegation back during these error flows.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
This vulnerability represents a state synchronization failure within the Network File System client implementation in the Linux kernel, specifically affecting how delegations are managed following an OPEN operation. In NFSv4 and its successor protocols defined by RFC 8881, a delegation is a mechanism that allows the server to temporarily grant exclusive or shared access rights to a file on behalf of the client, thereby reducing network traffic for subsequent read or write operations. When the server grants such a delegation in an OPEN reply, the client-side function nfs_inode_set_delegation() is responsible for recording this state locally so it can be properly managed later. However, a critical flaw exists within three specific error handling paths of this function where the code returns early without sending a DELEGRETURN message to the server. This omission violates the protocol specification which mandates that any delegation granted must eventually be relinquished via an explicit return command if not actively used or when state changes occur.
The operational impact of this flaw is severe and can lead to persistent client-side instability and degraded performance. Because the client silently drops its record of the delegation while the server retains it, a divergence in state occurs between the two endpoints. If the server subsequently decides to recall that delegation, perhaps due to conflicting access requests or internal policy changes, it sends a CB_RECALL callback to the client. Since the client no longer holds any record of this specific stateid, it cannot process the recall correctly and responds with NFS4ERR_BADHANDLE. The server interprets this error as an indication that the delegation is invalid but still active in some form, leading it to revoke the delegation and move it onto its cl_revoked list. Crucially, because the client failed to send DELEGRETURN initially, it also fails to send the subsequent FREE_STATEID message required to fully drain and clean up this revoked state on the server side.
This incomplete cleanup triggers a cascading failure mode within the NFS protocol exchange. Every subsequent SEQUENCE reply from the server begins to carry the status flag SEQ4_STATUS_RECALLABLE_STATE_REVOKED, signaling that there are pending revocations affecting the client's session. In response, the client's state manager enters an infinite or near-infinite loop, continuously issuing TEST_STATEID requests across its delegations in an attempt to resolve the outstanding issues. This behavior consumes significant CPU resources and network bandwidth without resolving the underlying problem, effectively causing a denial of service for that specific NFS mount point until manual intervention occurs. The vulnerability is particularly exploitable in modern configurations where servers offer write delegations on any write OPEN operation, as this increases the frequency with which such state mismatches can occur during race conditions involving re-opens and delegation recalls.
From a classification perspective, this issue aligns closely with CWE-401, Missing Release of Resource after Effective Lifetime, as the client fails to properly release or synchronize its claim on a resource that is managed by an external entity. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, given the race condition nature where a delegation recall races against a re-open operation resulting in inconsistent state handling. In terms of MITRE ATT&CK mapping, this vulnerability could be leveraged for Denial of Service (T1499) by exhausting client resources through the described loop behavior, or potentially used to disrupt availability in enterprise environments relying on NFS storage.
To mitigate this risk, the primary remediation is the application of kernel patches that correct the error handling logic within nfs_inode_set_delegation(). The fix ensures that instead of silently dropping the delegation during these specific error flows, the client explicitly hands the delegation back to the server via a DELEGRETURN message before returning from the function. This maintains state consistency between the client and server, preventing the accumulation of revoked states on the server side and stopping the subsequent loop in the client's state manager. Administrators should ensure that all Linux systems running NFS clients are updated with the latest kernel versions containing this fix. Additionally, monitoring for high CPU usage or network latency spikes associated with specific NFS mounts can help identify instances where this vulnerability is being triggered due to unpatched software.