CVE-2026-64519

Not scored yetLast modified Nov 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix infinite loop in layout state revocation

find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1e33e1414bec54a4feafa9e67e2617031be0afe2, < d1fc00ec02e9deb3f8d2bd59caf938c554fbc576; >= 1e33e1414bec54a4feafa9e67e2617031be0afe2, < fe59ae27d7346245f5d8d97220f374e63efd28b5; >= 1e33e1414bec54a4feafa9e67e2617031be0afe2, < 44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605; >= 1e33e1414bec54a4feafa9e67e2617031be0afe2, < 4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1
LinuxLinux6.9

References

Timeline

Published
Jul 25, 2026
Last modified
Nov 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-64524.3The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This CVE-2026-645208.4In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The register-bCVE-2026-64521In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pCVE-2026-645228.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_CVE-2026-645239.8In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nlCVE-2026-645247.7In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVIDCVE-2026-64525In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit TheCVE-2026-64526In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnl_ops_complete() tsconfig_prepare_dCVE-2026-64527In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receCVE-2026-64528In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpCVE-2026-645297.8In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driverCVE-2026-64536.5The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insuffic
CVE-2026-64519: Unscored | Vulnix