CVE-2026-89685

Received Received - Intake

Denial of Service in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline. This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients. Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89685

EUVD

EUVD-2026-76597

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a clock domain mismatch in the NFS server's clients_still_reclaiming() function. The function incorrectly compares a deadline based on CLOCK_REALTIME (system boot time) with CLOCK_BOOTTIME (time since boot). This comparison will almost never be true, allowing any client to indefinitely block non-reclaim operations by sending specific OPEN requests.

Detection Guidance

This vulnerability affects NFS servers running vulnerable Linux kernels. Detection involves checking kernel version and NFS server behavior. Look for NFS clients stuck in reclaim state or excessive grace period delays. Check kernel logs for NFS-related errors or timeouts. Use commands like 'uname -a' to check kernel version and 'dmesg | grep nfsd' to inspect NFS server logs.

Impact Analysis

If you use NFS (Network File System) with this vulnerable Linux kernel version, an attacker could exploit this flaw to cause a denial of service. This would prevent other clients from accessing files on the NFS server, disrupting normal operations and potentially causing system downtime.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for CVE-2026-89685. Restart NFS services after updating. Monitor NFS server performance and client connections to ensure normal operation. If immediate patching isn't possible, restrict NFS client access temporarily until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-89685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70