CVE-2026-23050

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23050", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.950Z", "datePublished": "2026-02-04T16:04:19.279Z", "dateUpdated": "2026-10-30T12:23:41.926Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:41.926Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n 1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/nfs4proc.c", "fs/nfs/pnfs.c", "fs/nfs/pnfs.h"], "versions": [{"version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "lessThan": "05a685b38dbca489d5f21eac9e7f20959344076a", "status": "affected", "versionType": "git"}, {"version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "lessThan": "c57387d447a2bcbaea009ba5f9497adf3de5edeb", "status": "affected", "versionType": "git"}, {"version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "lessThan": "a316fd9d3065b753b03d802530004aea481512cc", "status": "affected", "versionType": "git"}, {"version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "lessThan": "d6c75aa9d607044d1e5c8498eff0259eed356c32", "status": "affected", "versionType": "git"}, {"version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "lessThan": "857bf9056291a16785ae3be1d291026b2437fc48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/nfs4proc.c", "fs/nfs/pnfs.c", "fs/nfs/pnfs.h"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.67", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/05a685b38dbca489d5f21eac9e7f20959344076a"}, {"url": "https://git.kernel.org/stable/c/c57387d447a2bcbaea009ba5f9497adf3de5edeb"}, {"url": "https://git.kernel.org/stable/c/a316fd9d3065b753b03d802530004aea481512cc"}, {"url": "https://git.kernel.org/stable/c/d6c75aa9d607044d1e5c8498eff0259eed356c32"}, {"url": "https://git.kernel.org/stable/c/857bf9056291a16785ae3be1d291026b2437fc48"}], "title": "pNFS: Fix a deadlock when returning a delegation during open()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/nfs4proc.c", "fs/nfs/pnfs.c", "fs/nfs/pnfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "05a685b38dbca489d5f21eac9e7f20959344076a", "status": "affected", "version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "versionType": "git"}, {"lessThan": "c57387d447a2bcbaea009ba5f9497adf3de5edeb", "status": "affected", "version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "versionType": "git"}, {"lessThan": "a316fd9d3065b753b03d802530004aea481512cc", "status": "affected", "version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "versionType": "git"}, {"lessThan": "d6c75aa9d607044d1e5c8498eff0259eed356c32", "status": "affected", "version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "versionType": "git"}, {"lessThan": "857bf9056291a16785ae3be1d291026b2437fc48", "status": "affected", "version": "29ade5db12930ec60133f6a02791f4b1a4af2943", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/nfs4proc.c", "fs/nfs/pnfs.c", "fs/nfs/pnfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.67", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n 1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npNFS: Soluciona un interbloqueo al devolver una delegaci\u00f3n durante open()\n\nBen Coddington informa haber visto un cuelgue en el siguiente rastreo de pila:\n 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n 1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nEl problema es que se le est\u00e1 pidiendo a delegreturn que espere por un retorno de dise\u00f1o que no puede completarse porque se inici\u00f3 una recuperaci\u00f3n de estado. La recuperaci\u00f3n de estado no puede completarse hasta que open() termine de procesar las delegaciones que se le dieron.\n\nLa soluci\u00f3n es propagar las banderas existentes que indican una llamada no bloqueante a la funci\u00f3n pnfs_roc(), para que sepa no esperar en esta situaci\u00f3n."}], "id": "CVE-2026-23050", "lastModified": "2026-10-30T13:18:33.480", "metrics": {}, "published": "2026-02-04T17:16:15.663", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05a685b38dbca489d5f21eac9e7f20959344076a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/857bf9056291a16785ae3be1d291026b2437fc48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a316fd9d3065b753b03d802530004aea481512cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c57387d447a2bcbaea009ba5f9497adf3de5edeb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6c75aa9d607044d1e5c8498eff0259eed356c32"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: pNFS: Fix a deadlock when returning a delegation during open()", "id": "2436813", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436813"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23050", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23050\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23050\nhttps://lore.kernel.org/linux-cve-announce/2026020450-CVE-2026-23050-378c@gregkh/T"], "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-16T07:00:13.877997+00:00", "value": {"mitigation_remediation": ["Apply a Linux kernel update that includes the commit 857bf9056291a16785ae3be1d291026b2437fc48 or later, ensuring the deadlock fix is present.", "If an update cannot be applied promptly, reconfigure the NFS server to disable delegation returns (e.g., export options like \"no_root_squash\" or limiting to read\u2011only mounts) to avoid invoking the problematic code path.", "Continuously monitor system logs for NFS or kernel deadlock traces and plan for a controlled reboot if a hang is detected, thereby restoring service availability."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All Linux kernel packages that include the NFSpFS code and have not been patched with the fix for commit 857bf9056291a16785ae3be1d291026b2437fc48. No version range is explicitly listed, so the vulnerability exists in any kernel prior to the commit that introduced the deadlock fix.", "description_and_impact": "A deadlock occurs in the Linux kernel\u2019s pNFS subsystem when a delegation return operation waits for a layout return that can never complete because a state recovery is in progress. The recovery cannot finish until the associated open() call processes the delegation, causing the kernel scheduler to block indefinitely. This results in a system hang that effectively brings affected services or the entire host to a stop. The weakness is a concurrency flaw, specifically improper synchronization between delegation handling and state recovery.", "risk_and_exploitability": "The CVSS score of 7.0 indicates high severity, yet the EPSS score of less than 1% and lack of listing in the CISA KEV catalog suggest a very low likelihood of active exploitation. The most plausible attack vector involves triggering the faulty delegation return during an NFS open() operation\u2014either through normal use of NFSv4 with delegations or by crafted requests that induce state recovery. Because the issue manifests as a deadlock rather than an attack surface with direct code execution, the overall risk is primarily availability loss rather than confidentiality or integrity compromise."}}}}, "created": "2026-04-16T07:15:28.166151+00:00", "updated": "2026-04-16T07:15:28.166175+00:00", "vendors": [], "weaknesses": ["CWE-667"]}