CVE-2026-89685

nfsd: fix clock domain mismatch in clients_still_reclaiming()

State: Published
Severity: 7.5 High
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix clock domain mismatch in clients_still_reclaiming()

clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline.

This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients.

Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 7ca44a63d9a554ba7ad05b06d88746eab08b760eAffected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 2c9efc6b692a153643d0f204b3c3632cb6b5761eAffected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before a22ee3a2cadef44f2edeb909ae36bd72450a3a35Affected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 04c3e4456fe76e8d7c94171009df3165c3262c51Affected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before e92e80c5b043108029bc729b30d12c37158fb9cbAffected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before f9cec313efb2fd18d962aad738a4892bce806016Affected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 9843649196221152b6e5d138a3ce859bdaae1d96Affected 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 09ea3eb9a518565f5bca386e81b993ed8825f5e8Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 7ca44a63d9a554ba7ad05b06d88746eab08b760eAffected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 2c9efc6b692a153643d0f204b3c3632cb6b5761eAffected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before a22ee3a2cadef44f2edeb909ae36bd72450a3a35Affected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 04c3e4456fe76e8d7c94171009df3165c3262c51Affected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before e92e80c5b043108029bc729b30d12c37158fb9cbAffected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before f9cec313efb2fd18d962aad738a4892bce806016Affected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 9843649196221152b6e5d138a3ce859bdaae1d96Affected
20b7d86f29d39e8ae19bb29c24ffee70dc385ddf to before 09ea3eb9a518565f5bca386e81b993ed8825f5e8Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.