EUVD-2026-76597
GHSA-3574-3v33-rcrf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable NFSv4 server, no credentials needed beyond export permit; AC:L since restart-triggered grace is routine; A:H only, no C/I impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix clock domain mismatch in clients_still_reclaiming()
clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false - it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline.
This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients.
Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.
AnalysisAI
Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network connectivity to the target NFS server on port 2049, with the attacker's client address permitted by the server's export configuration; (2) the NFSv4 server must be actively within a grace period - this occurs after every kernel restart and lasts ~90 seconds by default, but the bug causes it to extend indefinitely if an attacker begins sending CLAIM_PREVIOUS; (3) the kernel version must be 5.6 or later and unpatched. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) is directionally correct but somewhat generous: NFS servers are routinely protected behind export-list access controls, and exploitation requires the server to be actively in a grace period (i.e., post-restart). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to a fixed release: 7.2.4, 6.18.51, or 7.3-rc1 for the respective stable branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux NFSv4 servers in your infrastructure and document their current kernel versions and patch status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today