A race condition vulnerability in the Linux kernel NFS server, identified as CVE-2026-89686, allows remote unauthenticated attackers to trigger a denial of service via kernel panic.

This vulnerability is a race condition in the nfsd4_alloc_layout_stateid function caused by improper locking when handling delegation revocation. An unauthenticated attacker can trigger this race by coordinating multiple NFS clients to force a delegation recall, ultimately causing the kernel to crash.

Successful exploitation of this vulnerability results in an immediate kernel panic, leading to a complete denial of service for the affected NFS server. Given the CVSS score of 9.8, this represents a critical risk to availability, as it can be triggered remotely by unauthenticated actors, potentially disrupting critical file storage and data access services across an organization.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages specifically related to nfsd or filesystem delegation operations.

Compensating Controls: Restrict access to the NFS service to trusted network segments using firewalls or network access control lists to prevent external unauthenticated access.

Public Exploit Available: No

The severity of this vulnerability is critical, as it allows remote disruption of kernel stability without requiring authentication. Administrators should prioritize patching the Linux kernel across all affected NFS server infrastructure to eliminate the risk of service interruption caused by this race condition.