A deadlock occurs in the Linux kernel’s pNFS subsystem when a delegation return operation waits for a layout return that can never complete because a state recovery is in progress. The recovery cannot finish until the associated open() call processes the delegation, causing the kernel scheduler to block indefinitely. This results in a system hang that effectively brings affected services or the entire host to a stop. The weakness is a concurrency flaw, specifically improper synchronization between delegation handling and state recovery.

All Linux kernel packages that include the NFSpFS code and have not been patched with the fix for commit 857bf9056291a16785ae3be1d291026b2437fc48. No version range is explicitly listed, so the vulnerability exists in any kernel prior to the commit that introduced the deadlock fix.

The CVSS score of 7.0 indicates high severity, yet the EPSS score of less than 1% and lack of listing in the CISA KEV catalog suggest a very low likelihood of active exploitation. The most plausible attack vector involves triggering the faulty delegation return during an NFS open() operation—either through normal use of NFSv4 with delegations or by crafted requests that induce state recovery. Because the issue manifests as a deadlock rather than an attack surface with direct code execution, the overall risk is primarily availability loss rather than confidentiality or integrity compromise.