{"id":"CVE-2026-23050","state":"PUBLISHED","title":"pNFS: Fix a deadlock when returning a delegation during open()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n  1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation.","publishedAt":"2026-02-04T16:04:19.279Z","updatedAt":"2026-10-30T12:23:41.926Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"05a685b38dbca489d5f21eac9e7f20959344076a","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"c57387d447a2bcbaea009ba5f9497adf3de5edeb","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"a316fd9d3065b753b03d802530004aea481512cc","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"d6c75aa9d607044d1e5c8498eff0259eed356c32","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"857bf9056291a16785ae3be1d291026b2437fc48","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/nfs4proc.c","fs/nfs/pnfs.c","fs/nfs/pnfs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.67","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.7","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/nfs4proc.c","fs/nfs/pnfs.c","fs/nfs/pnfs.h"]}],"references":["https://git.kernel.org/stable/c/05a685b38dbca489d5f21eac9e7f20959344076a","https://git.kernel.org/stable/c/c57387d447a2bcbaea009ba5f9497adf3de5edeb","https://git.kernel.org/stable/c/a316fd9d3065b753b03d802530004aea481512cc","https://git.kernel.org/stable/c/d6c75aa9d607044d1e5c8498eff0259eed356c32","https://git.kernel.org/stable/c/857bf9056291a16785ae3be1d291026b2437fc48"],"weaknesses":[],"ingestedAt":"2026-10-30T12:40:04.423Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23050.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23050","state":"PUBLISHED","datePublished":"2026-02-04T16:04:19.279Z","dateUpdated":"2026-10-30T12:23:41.926Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:45.950Z"},"containers":{"cna":{"title":"pNFS: Fix a deadlock when returning a delegation during open()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n  1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"05a685b38dbca489d5f21eac9e7f20959344076a","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"c57387d447a2bcbaea009ba5f9497adf3de5edeb","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"a316fd9d3065b753b03d802530004aea481512cc","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"d6c75aa9d607044d1e5c8498eff0259eed356c32","versionType":"git"},{"version":"29ade5db12930ec60133f6a02791f4b1a4af2943","status":"affected","lessThan":"857bf9056291a16785ae3be1d291026b2437fc48","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/nfs4proc.c","fs/nfs/pnfs.c","fs/nfs/pnfs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.67","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.7","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/nfs4proc.c","fs/nfs/pnfs.c","fs/nfs/pnfs.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/05a685b38dbca489d5f21eac9e7f20959344076a"},{"url":"https://git.kernel.org/stable/c/c57387d447a2bcbaea009ba5f9497adf3de5edeb"},{"url":"https://git.kernel.org/stable/c/a316fd9d3065b753b03d802530004aea481512cc"},{"url":"https://git.kernel.org/stable/c/d6c75aa9d607044d1e5c8498eff0259eed356c32"},{"url":"https://git.kernel.org/stable/c/857bf9056291a16785ae3be1d291026b2437fc48"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:23:41.926Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.6.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.12.67"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.18.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}