CVE-2026-46256 - Vulnerability Details

- NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

LOCALIO is an NFS loopback mount optimization that avoids using the
network for READ, WRITE and COMMIT if the NFS client and server are
determined to be on the same system. But because LOCALIO is still
fundamentally "just NFS loopback mount" it is susceptible to recursion
deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then
back into NFS via nfs_writepages.

Fix LOCALIO's potential for direct reclaim deadlock by ensuring that
all its page cache allocations are done from GFP_NOFS context.

Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs:
prevent stack overflows from page cache allocation").

Published: 2026-06-03

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel's LOCALIO NFS loopback mount optimization allows a recursion deadlock during direct reclaim. The bug stems from allocating page cache in an improper context, which can cause a LOCALIO mount that chains through XFS back into NFS via nfs_writepages to recursively reclaim pages until the kernel becomes blocked and system resources are exhausted, resulting in a denial of service. This is a manifestation of the loopback mount vulnerability (CWE-667) and the recursive deadlock flaw (CWE-833).

Affected Systems

All Linux kernel builds that include the NFS LOCALIO loopback mount and were compiled before the patch commit ad22c7a043c2 are affected. The vulnerability applies to every version of the Linux kernel that implements this optimization and has not yet been updated to the fixed code.

Risk and Exploitability

The likely attack vector is local, requiring privileged access to set up a LOCALIO mount. No public exploits have been disclosed and the EPSS score is < 1%. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS score of 5.5 indicates a medium severity, and because the flaw can lead to a kernel deadlock, it poses a denial of service risk if triggered, but its exploitability is limited to environments where a malicious user can mount a LOCALIO NFS loopback.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< ae26a4cf2baf0a44c538dc093504d1994b02dade
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< 6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9
`70ba381e1a431245c137ed597ec6a05991c79bd9`	affected	< 67435d2d8a33a75f9647724952cb1b18279d2e95

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[70ba381e1a431245c137ed597ec6a05991c79bd9,ae26a4cf2baf0a44c538dc093504d1994b02dade)`	affected	code_commit	—
`[70ba381e1a431245c137ed597ec6a05991c79bd9,6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9)`	affected	code_commit	—
`[70ba381e1a431245c137ed597ec6a05991c79bd9,67435d2d8a33a75f9647724952cb1b18279d2e95)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	generic	—
`[0,6.12)`	unaffected	generic	—
`[6.18.14,6.19.0)`	unaffected	generic	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch commit ad22c7a043c2, ensuring that LOCALIO page cache allocations use GFP_NOFS context
If an immediate kernel upgrade is not viable, disable NFS LOCALIO mounts by removing any "local_io" options from fstab or mount commands to prevent the deadlock path
Monitor system logs for signs of kernel deadlock or excessive memory usage that may indicate an attempt to exploit this recursion, and apply system hardening measures to restrict local privileged access

Generated by OpenCVE AI on June 9, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00099.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/67435d2d8a33a75f9647724952cb1b18279d2e95
https://git.kernel.org/stable/c/6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9
https://git.kernel.org/stable/c/ae26a4cf2baf0a44c538dc093504d1994b02dade
https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46256-e81d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46256
https://www.cve.org/CVERecord?id=CVE-2026-46256

History

Tue, 09 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-667

Thu, 04 Jun 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665 CWE-674

Thu, 04 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46256-e81d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46256 https://www.cve.org/CVERecord?id=CVE-2026-46256
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 03 Jun 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665 CWE-674

Wed, 03 Jun 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages LOCALIO is an NFS loopback mount optimization that avoids using the network for READ, WRITE and COMMIT if the NFS client and server are determined to be on the same system. But because LOCALIO is still fundamentally "just NFS loopback mount" it is susceptible to recursion deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then back into NFS via nfs_writepages. Fix LOCALIO's potential for direct reclaim deadlock by ensuring that all its page cache allocations are done from GFP_NOFS context. Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation").
Title		NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/67435d2d8a33a75f9647724952cb1b18279d2e95 https://git.kernel.org/stable/c/6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9 https://git.kernel.org/stable/c/ae26a4cf2baf0a44c538dc093504d1994b02dade

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-03T15:49:53.168Z

Updated: 2026-06-03T15:49:53.168Z

Reserved: 2026-05-13T15:03:33.108Z

Link: CVE-2026-46256

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-03T18:16:26.607

Modified: 2026-06-09T20:10:27.700

Link: CVE-2026-46256

Redhat

Severity : Low

Publid Date: 2026-06-03T00:00:00Z

Links: CVE-2026-46256 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-09T23:45:15Z

Weaknesses

CWE-667
Improper Locking
CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object