CVE-2026-64519 Overview
CVE-2026-64519 is a denial-of-service vulnerability in the Linux kernel NFS server (NFSD) subsystem. The flaw resides in the layout state revocation logic used by the pNFS layout stateid handling code. Specifically, nfsd4_revoke_states() fails to set sc_status on SC_TYPE_LAYOUT state IDs before invoking nfsd4_close_layout(). Because find_one_sb_stid() filters out only state IDs with a non-zero sc_status, the revoker repeatedly re-discovers the same layout stateid on every iteration. The retry loop never terminates, hanging the revocation task indefinitely and starving related NFSD workqueue activity.
Critical Impact
An unbounded retry loop in NFSD layout state revocation can hang the kernel revoker task, degrading NFS server availability for clients relying on pNFS layouts.
Affected Products
- Linux kernel versions containing the NFSD pNFS layout state revocation code prior to the referenced fixes
- NFS server deployments serving pNFS clients with layout stateids
- Distributions shipping affected mainline and stable kernel branches
Discovery Timeline
- 2026-07-25 - CVE-2026-64519 published to the National Vulnerability Database (NVD)
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64519
Vulnerability Analysis
The Linux kernel NFS server implements state revocation to clean up stale or expired client state, including layout stateids used by parallel NFS (pNFS). The revocation path iterates over per-superblock state IDs using find_one_sb_stid(), which is designed to skip entries whose sc_status field is non-zero. This filter allows the loop to make forward progress by excluding already-processed state IDs.
The defect lies in the SC_TYPE_LAYOUT branch of nfsd4_revoke_states(). This branch calls nfsd4_close_layout() on the discovered layout stateid but never updates sc_status beforehand. On the next iteration, find_one_sb_stid() re-selects the same layout stateid because its status remains zero. The revoker enters an infinite loop, hanging the executing kthread and blocking further state cleanup.
Root Cause
The root cause is a missing status update in a state machine transition [CWE-835: Loop with Unreachable Exit Condition]. The SC_TYPE_LAYOUT handling path diverges from the pattern used by other stateid types, which correctly set sc_status before dispatch. Without that write, the loop's exit predicate can never evaluate true for the current entry.
Attack Vector
Triggering the condition requires the kernel to enter the layout state revocation path with at least one SC_TYPE_LAYOUT stateid present. This typically occurs during pNFS client cleanup, lease expiry, or administrative state reset. The vulnerability manifests as a service availability issue rather than a memory-safety flaw. See the upstream fix commits (44e5e4e, 4f8ef58, d1fc00e, and fe59ae2) for the exact code change.
Detection Methods for CVE-2026-64519
Indicators of Compromise
- Kernel task hung warnings referencing nfsd4_revoke_states or nfsd4_close_layout in dmesg or /var/log/messages.
- One or more NFSD kernel threads pegged at high CPU with no forward progress on layout revocation.
- pNFS clients experiencing stalled recalls, layout returns, or delayed lease processing.
Detection Strategies
- Monitor kernel logs for hung_task_timeout_secs warnings whose stack traces include NFSD layout functions.
- Track running kernel version against the fixed commits referenced in the kernel.org stable tree.
- Sample NFSD worker CPU utilization and correlate spikes with pNFS client activity or state revocation events.
Monitoring Recommendations
- Enable CONFIG_DETECT_HUNG_TASK and forward kernel task-hung events to a centralized log pipeline.
- Alert on repeated appearances of nfsd4_revoke_states in stack traces exported by sysrq-t or /proc/*/stack.
- Track NFS server response latency and client-side pNFS layout errors as secondary availability signals.
How to Mitigate CVE-2026-64519
Immediate Actions Required
- Apply the upstream fix by upgrading to a kernel that includes the referenced commits from the stable tree.
- Coordinate reboots of NFS server hosts after installing patched kernel packages from your distribution.
- Inventory hosts that export NFSv4.1+ with pNFS layouts to prioritize patching windows.
Patch Information
The fix ensures sc_status is set for SC_TYPE_LAYOUT stateids before nfsd4_close_layout() is invoked, allowing find_one_sb_stid() to skip processed entries and terminate the loop. Patched commits are available in the Linux kernel stable tree: 44e5e4e, 4f8ef58, d1fc00e, and fe59ae2. Consume the fix through your Linux distribution's security update channel.
Workarounds
- Restrict pNFS layout usage on affected servers by exporting file systems without layout types until the kernel is patched.
- Restart the NFS service to clear a hung revoker task as a temporary recovery step, understanding the condition can recur.
- Limit exposure by hardening network access to NFSD to trusted client subnets while patch deployment is scheduled.
# Verify running kernel and confirm patch presence via distribution advisories
uname -r
# Example: query package manager for the installed kernel package version
# Debian/Ubuntu
dpkg -l | grep linux-image
# RHEL/Fedora
rpm -q kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
