CVE-2026-89686

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUG ON in nfsd4 alloc layout stateid on racing delegation revoke

nfsd4 alloc layout stateid reads fp->fi deleg file without holding fi lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi deleg file under fi lock, causing nfsd file get() to return NULL and triggering the BUG ON.

This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window.

Fix this by taking fi lock around the fi deleg file read in the SC TYPE DELEG path, matching the locking discipline of the find any file() arm, and replacing the BUG ON with a graceful error return that cleans up the partially-initialized layout stateid.