Linux kernel nfsd: deferred idmap upcall during NFSv4 compound decode wedges session slots

Impact

On a Linux NFS server, some NFSv4 operations (SETATTR among them) trigger an idmap lookup upcall while the compound arguments are still being decoded. If the upcall response is slow, cache_check() marks the request deferred and it gets dropped before the response encoder runs, so the session slot's NFSD4_SLOT_INUSE flag is never cleared. Every later request from that client fails its SEQUENCE op with NFSERR_JUKEBOX, so the mount is effectively dead until the client re-establishes state. For a fleet that mounts datasets, checkpoints or home directories over NFSv4 from a Linux exporter, a stalled idmapd on the server can take training jobs offline across many nodes at once, and the trigger is ordinary client traffic plus load, not a crafted request.

Who can reach it

Any authenticated NFSv4 client that can issue operations requiring an idmap lookup, combined with a slow or overloaded idmap helper on the server. No special privilege on the server; no unauthenticated path.

What to do

Update the NFS server's kernel to a stable release containing the fix (RQ_USEDEFERRAL cleared for the duration of nfs4svc_decode_compoundargs) and reboot the exporter. The affected code is server-side only, so client nodes do not need patching. No mitigation is given in the record beyond keeping the idmap helper responsive; a stuck client can be recovered by forcing it to re-establish its NFSv4 session.

References

Related entries

• Linux kernel CephFS: num_ops off-by-one on encrypted writeback panics the node under memory pressureCVE-2026-46066 · Linux kernel CephFS client (fscrypt writeback num_ops accounting)Medium
• Linux kernel CephFS client: stale xattr blob size hits a BUG_ON and panics the nodeCVE-2026-52961 · Linux kernel CephFS client (__ceph_build_xattrs_blob)Medium
• Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init(): On failure to set the energy-performance preferenceCVE-2026-53121 · Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init()Medium
• Linux iommu/amd - devid bounds check in __rlookup_amd_iommu(): The AMD IOMMU driver looked up device IDs withoutCVE-2026-53283 · Linux iommu/amd - devid bounds check in __rlookup_amd_iommu()Medium
• Linuxfabrik monitoring plugins: sudo-authorized checks read arbitrary root-readable files via --testCVE-2026-73974 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.lftest.test --test path handling)Medium
• community.general ipa_getkeytab: IPA/LDAP bind password written to logs and exposed in the process listCVE-2026-80158 · Ansible community.general ipa_getkeytab module (bind_pw not declared no_log)Medium