CVE-2026-45983 Details
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyond the allowed time limit, cache_check() will mark the request for deferral and cause it to be dropped. This prevents nfs4svc_encode_compoundres from being executed, and thus the session slot flag NFSD4_SLOT_INUSE never gets cleared. Subsequent client requests will fail with NFSERR_JUKEBOX, given that the slot will be marked as in-use, making the SEQUENCE op fail. Fix this by making sure that the RQ_USEDEFERRAL flag is always clear during nfs4svc_decode_compoundargs(), since no v4 request should ever be deferred.
A vulnerability in the Linux kernel's NFS server implementation can lead to improper request handling during ID mapping for NFSv4. Certain operations, like SETATTR, may trigger ID map lookup upcalls. If the responses to these upcalls are delayed beyond a specified limit, the request is marked for deferral and subsequently dropped. This disruption prevents the normal processing of NFSv4 compound responses, causing session management issues. Specifically, the session slot flag indicating 'in use' status is not cleared, leading to failed subsequent client requests. The vulnerability arises because the NFS server can inadvertently defer requests that should be processed immediately, creating a backlog and session slot leakage.
The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd | kernel.org | Patch |
| https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826 | kernel.org | Patch |
| https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.30, < 5.10.252 >= 5.11, < 5.15.202 >= 5.16, < 6.1.165 >= 6.2, < 6.6.128 >= 6.7, < 6.12.75 >= 6.13, < 6.18.14 >= 6.19, < 6.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | kernel.org |