CVE-2026-89685

A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd). A clock domain mismatch in the clients_still_reclaiming() function allows a remote attacker to indefinitely hold the server in a grace period. By sending specific CLAIM_PREVIOUS OPEN requests, an attacker can block all non-reclaim operations for other clients, leading to a denial of service (DoS).

An nfsd grace period logic bug occurs because clients_still_reclaiming computes a reclaim deadline from CLOCK_REALTIME boot_time but compares it with CLOCK_BOOTTIME. This clock domain mismatch can make the reclaim deadline effectively unreachable and can allow an NFSv4 client to keep the server in grace by sending CLAIM_PREVIOUS OPEN requests. While the server remains in grace, normal non-reclaim operations for other clients can be blocked, causing a remote denial of service for the exported NFS service. For the CVSS the PR:N is used because no privileges on the vulnerable server are required beyond network access to the NFS service. The base score uses AC:H because the trigger depends on the server being in the grace or reclaim phase, while the paranoid score uses AC:L because an attacker on a storage network may be able to observe or repeatedly target server restarts and then keep the condition active. Impact is availability loss only, with no evidence of memory corruption, information disclosure, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.