High 7.5Published Sep 11, 2026

CVE-2026-89685nfsd: fix clock domain mismatch in clients_still_reclaiming()

Updated under an hour ago (Oct 26, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline. This means any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients. Add boot_time_bt (CLOCK_BOOTTIME) alongside the existing boot_time and use it for the deadline computation. boot_time (CLOCK_REALTIME) is preserved for its cl_boot clientid-nonce role.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	20b7d86f29d39e8ae19bb29c24ffee70dc385ddf builds before 04c3e4456fe76e8d7c94171009df3165c3262c51; from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before e92e80c5b043108029bc729b30d12c37158fb9cb; from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before f9cec313efb2fd18d962aad738a4892bce806016; from 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf before 9843649196221152b6e5d138a3ce859bdaae1d96; 20b7d86f29d39e8ae19bb29c24ffee70dc385ddf builds before 09ea3eb9a518565f5bca386e81b993ed8825f5e8	CNA record

References

References

https://git.kernel.org/stable/c/04c3e4456fe76e8d7c94171009df3165c3262c51
https://git.kernel.org/stable/c/e92e80c5b043108029bc729b30d12c37158fb9cb
https://git.kernel.org/stable/c/f9cec313efb2fd18d962aad738a4892bce806016
https://git.kernel.org/stable/c/9843649196221152b6e5d138a3ce859bdaae1d96
https://git.kernel.org/stable/c/09ea3eb9a518565f5bca386e81b993ed8825f5e8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.