Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component can lead to a denial-of-service condition. When certain file attribute requests take too long to process, the server may incorrectly drop the request without clearing internal status flags. This causes the server to believe resources are still in use, eventually preventing legitimate clients from performing further operations.
Technical details
A flaw in the Linux kernel's nfsd implementation occurs during NFSv4 compound argument decoding. Certain operations, such as SETATTR, trigger idmap lookup upcalls; if these upcalls exceed a time limit, cache_check() marks the request for deferral and drops it. This prevents nfs4svc_encode_compoundres from executing, which in turn prevents the NFSD4_SLOT_INUSE flag from being cleared. Consequently, subsequent client requests fail with NFSERR_JUKEBOX because the session slots remain permanently marked as in-use. The fix involves ensuring the RQ_USEDEFERRAL flag is cleared during nfs4svc_decode_compoundargs() to prevent improper request dropping.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2025-12-22: other: Patch authored
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd
- https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4
- https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593
- https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826
- https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9
- https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23
- https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93