CVE-2026-46256

NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

Published Jun 3, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

LOCALIO is an NFS loopback mount optimization that avoids using the
network for READ, WRITE and COMMIT if the NFS client and server are
determined to be on the same system. But because LOCALIO is still
fundamentally "just NFS loopback mount" it is susceptible to recursion
deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then
back into NFS via nfs_writepages.

Fix LOCALIO's potential for direct reclaim deadlock by ensuring that
all its page cache allocations are done from GFP_NOFS context.

Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs:
prevent stack overflows from page cache allocation").

Analysis

Technical impact

A flaw in the Linux kernel's LOCALIO NFS loopback mount optimization allows a recursion deadlock during direct reclaim. The bug stems from allocating page cache in an improper context, which can cause a LOCALIO mount that chains through XFS back into NFS via nfs_writepages to recursively reclaim pages until the kernel becomes blocked and system resources are exhausted, resulting in a denial of service. This is a manifestation of the loopback mount vulnerability (CWE-667) and the recursive deadlock flaw (CWE-833).

Affected Systems

All Linux kernel builds that include the NFS LOCALIO loopback mount and were compiled before the patch commit ad22c7a043c2 are affected. The vulnerability applies to every version of the Linux kernel that implements this optimization and has not yet been updated to the fixed code.

Risk and Exploitability

The likely attack vector is local, requiring privileged access to set up a LOCALIO mount. No public exploits have been disclosed and the EPSS score is < 1%. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS score of 5.5 indicates a medium severity, and because the flaw can lead to a kernel deadlock, it poses a denial of service risk if triggered, but its exploitability is limited to environments where a malicious user can mount a LOCALIO NFS loopback.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< 9118e1cab8a5571c6a95011f77ff28480aee9cb0
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< ae26a4cf2baf0a44c538dc093504d1994b02dade
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< 6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< 67435d2d8a33a75f9647724952cb1b18279d2e95

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.114`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[70ba381e1a431245c137ed597ec6a05991c79bd9,ae26a4cf2baf0a44c538dc093504d1994b02dade)`	affected	code_commit	—
`[70ba381e1a431245c137ed597ec6a05991c79bd9,6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9)`	affected	code_commit	—
`[70ba381e1a431245c137ed597ec6a05991c79bd9,67435d2d8a33a75f9647724952cb1b18279d2e95)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.12`	affected	generic	—
`[0,6.12)`	unaffected	generic	—
`[6.18.14,6.19.0)`	unaffected	generic	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch commit ad22c7a043c2, ensuring that LOCALIO page cache allocations use GFP_NOFS context
If an immediate kernel upgrade is not viable, disable NFS LOCALIO mounts by removing any "local_io" options from fstab or mount commands to prevent the deadlock path
Monitor system logs for signs of kernel deadlock or excessive memory usage that may indicate an attempt to exploit this recursion, and apply system hardening measures to restrict local privileged access

Generated by OpenCVE AI on June 9, 2026 at 23:35 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.133% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/67435d2d8a33a75f9647724952cb1b18279d2e95
https://git.kernel.org/stable/c/6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9
https://git.kernel.org/stable/c/9118e1cab8a5571c6a95011f77ff28480aee9cb0
https://git.kernel.org/stable/c/ae26a4cf2baf0a44c538dc093504d1994b02dade
https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46256-e81d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46256
https://www.cve.org/CVERecord?id=CVE-2026-46256

History

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9118e1cab8a5571c6a95011f77ff28480aee9cb0

Jun 9, 2026 8:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-667

Jun 4, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-665 CWE-674

Jun 4, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46256-e81d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46256 https://www.cve.org/CVERecord?id=CVE-2026-46256
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jun 3, 2026 8:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-665 CWE-674

Jun 3, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages LOCALIO is an NFS loopback mount optimization that avoids using the network for READ, WRITE and COMMIT if the NFS client and server are determined to be on the same system. But because LOCALIO is still fundamentally "just NFS loopback mount" it is susceptible to recursion deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then back into NFS via nfs_writepages. Fix LOCALIO's potential for direct reclaim deadlock by ensuring that all its page cache allocations are done from GFP_NOFS context. Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation").
Title		NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/67435d2d8a33a75f9647724952cb1b18279d2e95 https://git.kernel.org/stable/c/6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9 https://git.kernel.org/stable/c/ae26a4cf2baf0a44c538dc093504d1994b02dade