CVE-2026-89685

The Linux kernel's in-kernel NFS server (nfsd) computes the NFSv4 grace-period deadline from nn->boot_time (CLOCK_REALTIME) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME), so the deadline check is effectively always false — it would take roughly 54 years of uptime for the comparison to succeed naturally. An unauthenticated remote client can exploit this by sending CLAIM_PREVIOUS OPEN requests that keep the server in its grace period indefinitely, during which all non-reclaim operations from every other client are rejected. The result is a network-reachable denial of service with no confidentiality or integrity impact (CVSS 3.1 score 7.5, availability-only). Any host running an affected kernel with the nfsd server enabled and reachable by untrusted or multi-tenant clients is affected; the fix adds a CLOCK_BOOTTIME-based boot_time_bt variable for the deadline while preserving boot_time for its clientid-nonce role. No public proof of concept exists, the flaw is not in CISA's KEV, and no exploitation is known.

What to do: Upgrade to a kernel containing the boot_time_bt fix as soon as your distribution ships it. Until patched, restrict nfsd exports and port 2049 to trusted client networks and IP allowlists so unauthenticated parties cannot reach the server, and monitor for NFSv4 clients issuing sustained CLAIM_PREVIOUS opens that keep the server stuck in grace after a restart (an nfsd restart resets the grace state). Note that only hosts actually running kernel nfsd are exposed — userspace NFS servers such as NFS-Ganesha do not use this code path.