CVE-2026-89685nfsd: fix clock domain mismatch in clients_still_reclaiming()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline. This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients. Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before e92e80c5b043108029bc729b30d12c37158fb9cb; from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before f9cec313efb2fd18d962aad738a4892bce806016; from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before 9843649196221152b6e5d138a3ce859bdaae1d96; 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf builds before 09ea3eb9a518565f5bca386e81b993ed8825f5e8 | CNA record |
References
- https://git.kernel.org/stable/c/e92e80c5b043108029bc729b30d12c37158fb9cb
- https://git.kernel.org/stable/c/f9cec313efb2fd18d962aad738a4892bce806016
- https://git.kernel.org/stable/c/9843649196221152b6e5d138a3ce859bdaae1d96
- https://git.kernel.org/stable/c/09ea3eb9a518565f5bca386e81b993ed8825f5e8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.