CVE-2026-64519
kernel: NFSD: Fix infinite loop in layout state revocation
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 25, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering an infinite loop during layout state revocation. The issue occurs because the system repeatedly attempts to revoke a layout state without properly updating its status, leading to the revoker hanging indefinitely.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
If the NFS server functionality is not required, disable the nfs-server service to prevent exploitation.
systemctl stop nfs-server
systemctl disable nfs-server
This action will stop all NFS server operations and prevent them from starting automatically. If the NFS server is in use, consider restricting network access to trusted clients via firewall rules.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')