The Linux kernel's nfsd component sets the NFSD4_CALLBACK_RUNNING bit to serialize recall work when breaking a delegation. If queuing the recall fails, the reference count is decremented but the RUNNING bit remains set. Since the only code clearing this bit runs from the workqueue, which is not reached if queuing fails, the bit remains latched. This causes subsequent break_lease() calls on the same delegation to skip the recall silently, leaving the delegation unbroken and causing conflicting opens or locks to stall. The fix clears the NFSD4_CALLBACK_RUNNING bit on the failure branch alongside decrementing the reference count.

The vulnerability can cause delegation recalls to be skipped silently, resulting in delegations never being broken. This can lead to stalls in conflicting open or lock operations on NFS shares, potentially impacting file access and causing denial of service conditions in affected systems.

A fix has been implemented in the Linux kernel to clear the NFSD4_CALLBACK_RUNNING bit when queuing a recall fails. Users should apply the official kernel updates that include this fix to resolve the issue. No additional mitigation steps are indicated.