Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server could allow a local attacker to cause a system hang. This occurs when the system attempts to revoke certain file layout states, leading to an infinite loop that stops the revocation process from completing. This can result in a denial-of-service condition affecting the availability of the file server.
Technical details
A flaw in the NFSD implementation in the Linux kernel causes an infinite loop in the nfsd4_revoke_states() function. The find_one_sb_stid() function is designed to skip state IDs (stids) with a non-zero status; however, the SC_TYPE_LAYOUT case fails to set the sc_status before calling nfsd4_close_layout(). Consequently, the retry loop repeatedly identifies the same layout stid, hanging the revoker thread indefinitely. This issue affects Linux kernel versions starting from 6.9 and has been patched in various stable branches including 6.12.92, 6.18.34, and 7.0.11.
Affected products
- Linux Linux 6.9 to 7.0.10
Timeline
- 2026-07-25: advisory: CVE-2026-64519 published by NVD
- 2026-06-01: patched: Fix committed to stable kernel branches