Linux Kernel CVE-2026-46256

NFS LOCALIO must be active - this feature is only engaged when the kernel determines that the NFS client and server reside on the same physical host (loopback NFS mount). The underlying filesystem below the NFS server must be XFS (or another filesystem whose page cache allocation path can recurse back into NFS). The attacker requires a local account with low privileges (CVSS PR:L confirmed). Exploitation additionally depends on triggering direct memory reclaim, which typically requires sustained memory pressure or write-heavy I/O on the LOCALIO-mounted path. What limits exploitation: the vulnerability cannot be triggered remotely (AV:L), requires no user interaction but does require a specific non-default deployment topology (co-located NFS with LOCALIO), and produces only availability impact with no data exfiltration or code execution primitive.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a local, low-complexity, low-privilege denial-of-service with no confidentiality or integrity impact. This scoring is internally consistent with the description: exploitation requires local authenticated access and a specific NFS LOCALIO deployment. EPSS at 0.02% (4th percentile) aligns with this assessment - the attack surface is narrow, requiring co-location of NFS client and server with LOCALIO active, plus triggered memory pressure. The CVE is not listed in CISA KEV and no POC is publicly identified. Real-world priority is low for most environments; organizations running hyperconverged or container-host NFS stacks where LOCALIO is plausibly active should prioritize patching over those with no loopback NFS usage. The 'Buffer Overflow' tag is almost certainly erroneous and should not influence exploit likelihood assessments - there is no memory corruption in this vulnerability class.

A local user on a system running an NFS LOCALIO mount initiates sustained write I/O to the loopback-mounted filesystem, generating memory pressure that triggers direct reclaim. The kernel allocator, lacking the GFP_NOFS constraint, descends from NFS LOCALIO into XFS page cache allocation, which in turn re-enters NFS via nfs_writepages, creating a circular wait condition. The result is a kernel deadlock and system hang, effectively a local denial of service. No public POC exists, but the condition can be reached through normal workload patterns on affected configurations.