CVE-2026-89681

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix layout fence worker double-reference race

The workqueue core clears WORK STRUCT PENDING before the callback is invoked, so delayed work pending() in lm breaker timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.

Replace the racy delayed work pending() check with an ls fence inflight boolean set atomically with refcount inc not zero() under ls lock, and cleared under ls lock before the final nfs4 put stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod delayed work() at the top of the worker.