HIGH Introduced in 5.6
nfsd GracePeriod Deadlock
CVE-2026-89685
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline. This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients. Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.
02KernelScan AI Analysis
Risk summary
Any NFSv4 client can send CLAIM_PREVIOUS OPEN requests to keep an NFSv4 server in grace period indefinitely, blocking all non-reclaim operations for all other clients. This is a network-reachable denial of service affecting NFS servers running kernels 5.6 through 7.2.x (before 7.2.4) or 6.18.x (before 6.18.51).
Vulnerability analysis
The NFSv4 server's grace-period deadline is computed using a wall-clock timestamp but compared against a monotonic boot-time clock, so the deadline is effectively unreachable and never expires. A malicious client can keep sending reclaim requests to hold the server in grace forever, during which all other clients are blocked from opening or locking files. The fix adds a separate boot-time clock value and uses it for the deadline comparison so the grace period ends correctly. Any network client that can reach the NFS server can trigger this; no special privileges are required beyond being an NFS client.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 5.6 | 6.18.51 | f9cec313efb2 |
| 7.2 | 5.6 | 7.2.4 | 984364919622 |
| mainline | 5.6 | 7.3-rc1 | 09ea3eb9a518 |
| 6.12 | 5.6 | 6.12.111 | e92e80c5b043 |
| cip/6.12 | 5.6 | 6.12.111-cip32 | e92e80c5b043 |