CVE-2026-89685

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix clock domain mismatch in clients_still_reclaiming()

clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline.

This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients.

Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < 7ca44a63d9a554ba7ad05b06d88746eab08b760e; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < 2c9efc6b692a153643d0f204b3c3632cb6b5761e; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < a22ee3a2cadef44f2edeb909ae36bd72450a3a35; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < 04c3e4456fe76e8d7c94171009df3165c3262c51; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < e92e80c5b043108029bc729b30d12c37158fb9cb; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < f9cec313efb2fd18d962aad738a4892bce806016; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < 9843649196221152b6e5d138a3ce859bdaae1d96; >= 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf, < 09ea3eb9a518565f5bca386e81b993ed8825f5e8
LinuxLinux5.6

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-896869.8In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revCVE-2026-896877.5In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->aCVE-2026-896889.8In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry ICVE-2026-896899.8In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() CVE-2026-89698.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-896907.8In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_statusCVE-2026-896917.1In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_reCVE-2026-896927.5In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_brCVE-2026-89693In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd4_cCVE-2026-89694In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On CVE-2026-896957.5In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posiCVE-2026-896967.5In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref W