CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK RUNNING on failed delegation recall queue

nfsd break one deleg() sets NFSD4 CALLBACK RUNNING via test and set bit at entry to serialize recall work, then calls nfsd4 run cb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that clears the bit is nfsd41 destroy cb() (fs/nfsd/nfs4callback.c), which runs from the workqueue and is therefore unreachable when nothing was queued.

The bit becomes a permanent latch on dp->dl recall.cb flags: every subsequent break lease() on the same delegation hits the early-return guard in nfsd break one deleg() and silently skips the recall, so the delegation is never broken and the conflicting open or lock stalls.

Fix by clearing NFSD4 CALLBACK RUNNING on the !queued branch alongside the refcount dec.