Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-89685 Details

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline. This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients. Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/09ea3eb9a518565f5bca386e81b993ed8825f5e8	kernel.org
https://git.kernel.org/stable/c/9843649196221152b6e5d138a3ce859bdaae1d96	kernel.org
https://git.kernel.org/stable/c/e92e80c5b043108029bc729b30d12c37158fb9cb	kernel.org
https://git.kernel.org/stable/c/f9cec313efb2fd18d962aad738a4892bce806016	kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

3 change records found show changes

Date	Action	Recorded By
Sep 21, 2026	CVE Modified	kernel.org
Sep 13, 2026	CVE Modified	kernel.org
Sep 11, 2026	New CVE Received	kernel.org