CVE-2026-90234

A flaw was found in the Linux kernel's Network File System (NFS) client. When an NFS server grants a delegation, the client may fail to record it and not send a DELEGRETURN message. This can lead to a situation where the server believes the client still holds the delegation. If the server then recalls this delegation, the client's state manager can enter an infinite loop, resulting in a denial of service (DoS) condition for the client.

An NFSv4 client can drop a server granted delegation without recording it locally and without returning it with DELEGRETURN. If the server later recalls that delegation, the client has no matching stateid and may answer CB_RECALL with NFS4ERR_BADHANDLE, which can leave revoked delegation state visible in later SEQUENCE replies. The client state manager can then loop over TEST_STATEID recovery and fail to clear the condition, causing denial of service or persistent degradation for affected NFS mounts. For the CVSS the PR:N is used because the attacker does not need privileges on the victim when acting as a malicious or compromised NFS server already used by the client. The issue is network reachable in NFSv4 deployments but normally requires access to the storage network or control of a trusted NFS server. Impact is availability only. No direct memory corruption or privilege escalation primitive is indicated by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.