CVE-2026-45983 - Vulnerability Details

- nfsd: never defer requests during idmap lookup

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: never defer requests during idmap lookup

During v4 request compound arg decoding, some ops (e.g. SETATTR)
can trigger idmap lookup upcalls. When those upcall responses get
delayed beyond the allowed time limit, cache_check() will mark the
request for deferral and cause it to be dropped.

This prevents nfs4svc_encode_compoundres from being executed, and
thus the session slot flag NFSD4_SLOT_INUSE never gets cleared.
Subsequent client requests will fail with NFSERR_JUKEBOX, given
that the slot will be marked as in-use, making the SEQUENCE op
fail.

Fix this by making sure that the RQ_USEDEFERRAL flag is always
clear during nfs4svc_decode_compoundargs(), since no v4 request
should ever be deferred.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s NFS daemon invalidates session slot management during V4 request argument decoding. When an ID mapping lookup upcall is timed out, the request is marked for deferral and dropped, preventing the normal response encoding from executing. Consequently the session slot flag never clears, causing subsequent client operations to fail with an NFSERR_JUKEBOX error, effectively denying service to legitimate clients and disrupting file system operations.

Affected Systems

All Linux distributions running the Linux kernel exposed to the NFS daemon are potentially susceptible, as the vulnerability is located in the kernel’s NFS server implementation (nfsd). No vendor‑specific version list was provided, but any kernel configuration that enables NFSv4 without the patch is affected.

Risk and Exploitability

The vulnerability appears to be exploitable through crafted NFSv4 client requests that trigger ID mapping lookups. The EPSS score is not available, but the absence of a KEV listing indicates it has not yet been observed in the wild as a known exploit. Nonetheless, the CVSS score of 7.0 suggests a serious impact, and an attacker with network access to the NFS server could reliably induce a denial of service by sending repeated compound operations. The fix requires kernel changes that prevent any NFSv4 request from being deferred during idmap lookup.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< b9abb760db20504240a7147f27934d900cd80b23
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< 3a72c7dedc99b321e0f267e4e999e5baf07c4593
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< 99e17b20fddac19a228d213e00f6b9e1c10daff9
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< 243f71ed873ff3feeb6f9b5cb145d63f7188b4c4
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< 063a6f22478ef929625000a2caf54667725c1dfd
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< d75ec4504a4340b033b15cad0303988b3089dd93
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< 8dff54fe88c0dcd4c55bff9fc2fa6ca968290826
`2f425878b6a71571341dcd3f9e9d1a6f6355da9c`	affected	< f9c206cdc4266caad6a9a7f46341420a10f03ccb

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,b9abb760db20504240a7147f27934d900cd80b23)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,3a72c7dedc99b321e0f267e4e999e5baf07c4593)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,99e17b20fddac19a228d213e00f6b9e1c10daff9)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,243f71ed873ff3feeb6f9b5cb145d63f7188b4c4)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,063a6f22478ef929625000a2caf54667725c1dfd)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,d75ec4504a4340b033b15cad0303988b3089dd93)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,8dff54fe88c0dcd4c55bff9fc2fa6ca968290826)`	affected	code_commit	—
`[2f425878b6a71571341dcd3f9e9d1a6f6355da9c,f9c206cdc4266caad6a9a7f46341420a10f03ccb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	semver	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.14,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the patch which clears the RQ_USEDEFERRAL flag during nfs4svc_decode_compoundargs().
After applying the kernel update, restart the NFS service (nfsd) to load the new code into memory.
Reboot the system to ensure the patched kernel fully takes effect and all services use the updated code.

Generated by OpenCVE AI on May 28, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00122.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd
https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4
https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593
https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826
https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9
https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23
https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93
https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb
https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45983-59f2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45983
https://www.cve.org/CVERecord?id=CVE-2026-45983

History

Tue, 16 Jun 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 28 May 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-640 CWE-775

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45983-59f2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45983 https://www.cve.org/CVERecord?id=CVE-2026-45983
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-640 CWE-775

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyond the allowed time limit, cache_check() will mark the request for deferral and cause it to be dropped. This prevents nfs4svc_encode_compoundres from being executed, and thus the session slot flag NFSD4_SLOT_INUSE never gets cleared. Subsequent client requests will fail with NFSERR_JUKEBOX, given that the slot will be marked as in-use, making the SEQUENCE op fail. Fix this by making sure that the RQ_USEDEFERRAL flag is always clear during nfs4svc_decode_compoundargs(), since no v4 request should ever be deferred.
Title		nfsd: never defer requests during idmap lookup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4 https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593 https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826 https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9 https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23 https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93 https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:18:41.619Z

Updated: 2026-05-27T12:18:41.619Z

Reserved: 2026-05-13T15:03:33.090Z

Link: CVE-2026-45983

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:15.500

Modified: 2026-06-16T02:39:11.907

Link: CVE-2026-45983

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45983 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T04:00:10Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object