CyberRota Analysis
AI-GeneratedA race condition vulnerability exists in the Linux kernel's NFS server (nfsd), where a duplicate reference to the layout state ID can be taken due to improper handling of workqueue states. This can lead to a memory leak, potentially affecting system stability and resource management. Linux system administrators and developers should prioritize applying the fix to mitigate the risk of resource exhaustion and ensure the integrity of NFS operations.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid. Replace the racy delayed_work_pending() check with an ls_fence_inflight boolean set atomically with refcount_inc_not_zero() under ls_lock, and cleared under ls_lock before the final nfs4_put_stid() on the dispose path; the retry path intentionally retains it. Remove the self-rearm mod_delayed_work() at the top of the worker.