CVE-2026-45983: Linux Kernel NFSD DoS Vulnerability

CVE-2026-45983 Overview

CVE-2026-45983 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw occurs during NFSv4 compound argument decoding when operations such as SETATTR trigger idmap lookup upcalls. Delayed upcall responses cause cache_check() to mark the request for deferral, dropping it before nfs4svc_encode_compoundres can execute.

Because the response is never encoded, the session slot flag NFSD4_SLOT_INUSE is never cleared. Subsequent client requests fail with NFSERR_JUKEBOX since the SEQUENCE operation rejects the slot as in-use. The fix ensures the RQ_USEDEFERRAL flag is cleared during nfs4svc_decode_compoundargs() because no v4 request should ever be deferred.

Critical Impact
NFSv4 clients can encounter persistent request failures and effective denial of service against an affected NFS server when idmap upcalls exceed the cache timeout window.

Affected Products

Linux kernel versions containing the nfsd NFSv4 idmap lookup code path prior to the referenced stable patches
Linux distributions shipping vulnerable kernel builds that expose NFSv4 services with idmapping enabled
Storage and file server appliances built on affected Linux kernel releases

Discovery Timeline

2026-05-27 - CVE-2026-45983 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45983

Vulnerability Analysis

The vulnerability resides in the NFSv4 server compound argument decoding path inside nfs4svc_decode_compoundargs(). NFSv4 compound requests can contain operations like SETATTR that require translating user and group identifiers through idmap. The kernel issues an upcall to a userspace helper to resolve these mappings.

When the helper does not respond within the cache timeout, cache_check() defers the request. Deferral is appropriate for many sunrpc paths, but it is incompatible with NFSv4 session semantics. The dropped request never reaches nfs4svc_encode_compoundres, which is responsible for clearing the per-slot state established by the SEQUENCE operation.

Root Cause

The root cause is an interaction between the generic sunrpc deferral mechanism and NFSv4 session slot tracking. The RQ_USEDEFERRAL request flag remained set during compound decoding, allowing cache_check() to defer a v4 request that the protocol assumes will always run to completion. With the NFSD4_SLOT_INUSE bit left asserted, the session slot becomes permanently unusable for the affected client, classifying this as a state-management defect rather than a memory safety issue.

Attack Vector

An NFSv4 client connected to an affected server can trigger the condition by issuing compound operations that require idmap resolution while the idmap helper is slow, unresponsive, or under load. Once a session slot is stuck, the client receives repeated NFSERR_JUKEBOX responses on the SEQUENCE operation, blocking further progress on that slot. The vulnerability does not require authentication beyond what the NFSv4 server already accepts, and it does not require code execution on the server. See the upstream stable patches such as Kernel Patch 063a6f22478e and Kernel Patch 3a72c7dedc99 for the corrected handling.

Detection Methods for CVE-2026-45983

Indicators of Compromise

Recurring NFSERR_JUKEBOX (NFS4ERR_JUKEBOX / status 10008) responses returned to NFSv4 clients from a specific server
Kernel log entries showing delayed or failed idmap upcalls from nfsidmap or rpc.idmapd around the time of client errors
NFSv4 clients reporting hung SETATTR operations or stalled sessions that recover only after session reset

Detection Strategies

Monitor cache_check() deferral counts and idmap cache miss rates on NFS servers using /proc/net/rpc/nfs4.idtoname and /proc/net/rpc/nfs4.nametoid statistics
Correlate NFSv4 server-side NFSERR_JUKEBOX emission rates with idmap helper latency to identify the deferral pattern described in the advisory
Track the running kernel version and nfsd module build against the list of upstream stable patches to identify unpatched hosts

Monitoring Recommendations

Alert on sustained NFSERR_JUKEBOX responses from production NFS servers, which should be rare under normal operation
Instrument the idmap helper process for liveness and response latency, escalating when responses exceed the sunrpc cache timeout
Capture NFSv4 packet traces during incident windows to confirm SEQUENCE failures tied to specific session slot identifiers

How to Mitigate CVE-2026-45983

Immediate Actions Required

Identify all Linux NFSv4 servers and inventory their kernel versions against the upstream stable patch list
Apply the vendor-supplied kernel update that incorporates the nfsd: never defer requests during idmap lookup fix
Restart affected NFS services or reboot hosts after patching to ensure the corrected nfsd code path is active

Patch Information

The fix clears the RQ_USEDEFERRAL flag inside nfs4svc_decode_compoundargs() so that NFSv4 requests are never deferred during idmap lookup. The upstream commits are available at Kernel Patch 063a6f22478e, Kernel Patch 243f71ed873f, Kernel Patch 3a72c7dedc99, Kernel Patch 8dff54fe88c0, Kernel Patch 99e17b20fdda, Kernel Patch b9abb760db20, Kernel Patch d75ec4504a43, and Kernel Patch f9c206cdc426. Apply the patch matching your stable kernel branch.

Workarounds

Ensure the idmap helper (nfsidmap or rpc.idmapd) is healthy, well-resourced, and not blocked on slow directory services such as LDAP
Where feasible, reduce reliance on idmap by aligning UID and GID namespaces between NFS clients and servers so lookups resolve from cache
Restart nfsd or reset affected NFSv4 sessions to recover stuck slots until the kernel patch is deployed

bash

# Verify running kernel and nfsd module after patching
uname -r
modinfo nfsd | grep -E 'filename|version|srcversion'

# Check idmap helper status
systemctl status nfs-idmapd
journalctl -u nfs-idmapd --since '1 hour ago'