Executive brief
The Linux kernel's NFS server implementation contains a timing logic error that allows a remote client to indefinitely block all file-sharing operations for legitimate users. An attacker can send specially crafted NFS requests that exploit a clock mismatch in the grace period calculation, causing the server to never exit recovery mode. This effectively denies service to all other NFS clients attempting normal operations.
Technical details
The vulnerability is a logic error in the nfsd (NFS server daemon) grace period management. The function clients_still_reclaiming() computes a deadline using nn->boot_time (CLOCK_REALTIME, approximately 1.7 billion seconds since 1970) and compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since system boot). Because CLOCK_REALTIME values vastly exceed CLOCK_BOOTTIME values on any system running less than ~54 years continuously, the comparison always evaluates false, keeping the server perpetually in grace period. A remote attacker can send CLAIM_PREVIOUS OPEN requests to exploit this, blocking all non-reclaim operations for other clients. The fix introduces boot_time_bt (CLOCK_BOOTTIME timestamp) alongside the existing boot_time, using the correct clock domain for deadline comparison. Patches are available in mainline and stable kernel branches.
Affected products
- Linux Linux kernel All versions with nfsd grace period grace period calculation; patched in mainline and stable branches as of 2026-09-11
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-06-11: patched: Patch authored by Jeff Layton; merged upstream commit 09ea3eb9a518565f5bca386e81b993ed8825f5e8
- 2026-09-07: patched: Stable backport commit 9843649196221152b6e5d138a3ce859bdaae1d96