Linux Kernel EUVD-2026-81827

Requires a Linux host acting as an NFSv4 client mounted against a server that issues write delegations on write OPENs (the modern default behavior the description calls out). The bug is reached only when a delegation recall races a concurrent re-open and the client takes one of three error paths in nfs_inode_set_delegation() that return without sending DELEGRETURN. Limiting factors: it is client-side (impact falls on the mounting host, not the server), depends on a timing race plus a specific error condition rather than a deterministic single request, and requires NFSv4 delegations to be in use - so it does not affect NFSv3 or delegation-disabled configurations.

This is a client-side availability defect in the Linux NFSv4 implementation, not a memory-corruption or disclosure bug. The vendor CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) correctly captures a pure availability impact (C:N/I:N/A:H), but the AC:L rating is optimistic: the description explicitly frames triggering as a race - 'a delegation recalled for one opener races a re-open that the server answers with a fresh write delegation' - and requires hitting one of three specific error flows in nfs_inode_set_delegation(). That is race- and error-path-dependent, which argues for AC:H. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is a degraded/hung NFS client (state manager spinning on TEST_STATEID indefinitely) rather than server compromise or data exposure, so this is a moderate-severity reliability bug - a real availability concern for NFSv4 datacenter clients but not an urgent internet-facing priority. Note the input tag 'Information Disclosure' conflicts with the CVSS vector (C:N), which indicates a mislabeled category, not an actual confidentiality impact.

A Linux NFSv4 client mounts a server that grants write delegations on write OPENs. A delegation recalled for one opener races a re-open that the server answers with a fresh write delegation; the client hits one of the three error flows and drops the delegation without sending DELEGRETURN. The server later recalls it, the client responds NFS4ERR_BADHANDLE, the server revokes the stateid, and the client's state manager loops issuing TEST_STATEID indefinitely, hanging NFS state recovery. No public proof-of-concept is identified in the provided data.