CVE-2026-23050: Linux Kernel pNFS DoS Vulnerability

CVE-2026-23050 Overview

A deadlock vulnerability has been identified in the Linux kernel's pNFS (parallel NFS) subsystem that occurs when returning a delegation during an open() operation. This race condition can cause system hangs when the delegreturn operation waits for a layout return that cannot complete due to an initiated state recovery process. The state recovery itself cannot complete until the open() finishes processing delegations, creating a circular dependency that results in a system hang.

Critical Impact

Systems using NFSv4 with pNFS layouts may experience complete hangs during file operations, potentially causing service disruptions in enterprise storage environments.

Affected Products

• Linux kernel with NFSv4 pNFS support
• Systems utilizing NFSv4 delegations with parallel NFS layouts
• Enterprise NFS storage configurations with delegation handling

Discovery Timeline

• February 4, 2026 - CVE-2026-23050 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23050

Vulnerability Analysis

This vulnerability represents a classic deadlock condition in the NFSv4 client implementation within the Linux kernel. The issue manifests in the pNFS return-on-close (pnfs_roc) functionality where improper synchronization between delegation returns and layout returns creates a circular wait dependency.

When a client performs an open() operation that triggers delegation processing via nfs_inode_set_delegation, the kernel may need to return an existing delegation. This delegation return process calls _nfs4_proc_delegreturn, which in turn invokes pnfs_roc() to handle any associated pNFS layouts. The pnfs_roc() function blocks waiting for the layout return to complete.

However, if state recovery is initiated during this process, the layout return cannot complete because the state recovery mechanism is waiting for the open() operation to finish processing its delegations. This creates an unresolvable circular dependency resulting in an indefinite system hang.

Root Cause

The root cause lies in the pnfs_roc() function not respecting the non-blocking flags that are already established in the calling context. When pnfs_roc() is called during a delegation return that originates from an open() operation, it should recognize that blocking operations may create deadlock conditions. The existing flags indicating a non-blocking call context were not being propagated to pnfs_roc(), causing it to wait unconditionally for layout returns that may never complete.

Attack Vector

This vulnerability is triggered through normal NFS file operations rather than malicious exploitation. The deadlock condition occurs when:

1. A client opens a file on an NFSv4 server with pNFS support
2. The server grants a new delegation that requires returning an existing delegation
3. The existing delegation has associated pNFS layouts
4. State recovery is triggered during the delegation return process

The attack vector involves local system operations against NFSv4 mounted filesystems with pNFS configurations. While not directly exploitable for code execution, the denial of service impact can be significant in enterprise environments.

The fix propagates the existing non-blocking flags to pnfs_roc() so it knows not to wait indefinitely when called from contexts where blocking could cause deadlocks. The relevant kernel commits implementing this fix are available in the kernel git repository.

Detection Methods for CVE-2026-23050

Indicators of Compromise

• System processes stuck in uninterruptible sleep (D state) with stack traces showing pnfs_roc and nfs4_proc_delegreturn
• NFS client operations timing out or hanging indefinitely
• Kernel log messages indicating NFS state recovery issues
• Process hangs during file open operations on NFSv4 mounted filesystems

Detection Strategies

• Monitor for processes in D state with NFS-related stack traces using cat /proc/<pid>/stack
• Implement kernel tracing on pnfs_roc and nfs4_proc_delegreturn functions to detect blocking patterns
• Use nfsstat to monitor for unusual delegation return statistics
• Configure SentinelOne Singularity Platform for endpoint monitoring to detect abnormal NFS client behavior patterns

Monitoring Recommendations

• Enable NFS client debugging via rpcdebug -m nfs -s all during troubleshooting
• Monitor system load averages and process states for signs of widespread hangs
• Implement alerting for NFS mount point availability and responsiveness
• Use kernel live patching monitoring to verify patch deployment status

How to Mitigate CVE-2026-23050

Immediate Actions Required

• Update Linux kernel to a patched version containing the fix
• Temporarily disable pNFS layouts if experiencing hangs by using mount option pnfs=no
• Consider reducing delegation usage with mount option nodelegation as a temporary workaround
• Monitor NFS client systems for signs of deadlock conditions

Patch Information

The Linux kernel development team has released fixes for this vulnerability. The patches are available through the following kernel git commits:

• Kernel Git Commit 857bf905
• Kernel Git Commit a316fd9d
• Kernel Git Commit d6c75aa9

Apply the appropriate patch for your kernel version through your distribution's package management system or by building from source.

Workarounds

• Mount NFSv4 filesystems with the pnfs=no option to disable parallel NFS layouts
• Use the nodelegation mount option to prevent delegation usage entirely
• Consider using NFSv3 temporarily if pNFS functionality is not critical
• Implement automatic process recovery mechanisms for affected NFS operations

# Configuration example - Disable pNFS layouts to prevent deadlock
# Add to /etc/fstab or mount command
mount -t nfs4 -o vers=4.1,pnfs=no server:/export /mnt/nfs

# Alternative: Disable delegations entirely
mount -t nfs4 -o vers=4.1,nodelegation server:/export /mnt/nfs