CVE-2026-64519 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix infinite loop in layout state revocation
find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability described represents a critical denial of service condition within the Linux kernel's network file system implementation, specifically affecting the nfsv4 server component. This issue manifests as an infinite loop during the state revocation process, which can lead to complete system unresponsiveness and resource exhaustion. The problem occurs in the nfsd4_revoke_states() function where layout state identifiers are being processed for revocation purposes.
The technical flaw stems from improper state management within the kernel's NFSv4 implementation where the find_one_sb_stid() function selectively skips state identifiers based on their sc_status field value. However, during layout state handling, the SC_TYPE_LAYOUT case fails to properly initialize or update the sc_status field before proceeding to call nfsd4_close_layout(). This omission creates a scenario where the same state identifier remains in an invalid state throughout multiple iterations of the retry loop.
The operational impact of this vulnerability is severe as it effectively hangs the NFS server's state revocation mechanism, causing indefinite blocking of legitimate operations. When the system attempts to revoke layout states for cleanup or resource management purposes, the infinite loop prevents any further progress in the revocation process. This condition can affect file access operations, storage management tasks, and overall system stability, particularly in environments heavily dependent on NFS services.
This vulnerability aligns with CWE-835 which describes infinite loops or iterations without proper termination conditions, and it demonstrates a classic case of improper state management within kernel subsystems. The issue also relates to ATT&CK technique T1499.001 which covers network denial of service attacks through resource exhaustion and system instability.
The fix for this vulnerability requires ensuring that the sc_status field is properly initialized or updated before calling nfsd4_close_layout() in the SC_TYPE_LAYOUT case. This modification ensures that state identifiers are correctly marked during the revocation process, allowing the retry loop to progress normally and preventing the infinite iteration scenario. System administrators should apply relevant kernel updates that contain this fix to prevent exploitation of this denial of service condition in production environments.