Linux kernel nfsd: transports routed to threadless service pools hang the connection indefinitely

Impact

When nfsd runs in pernode or percpu pool mode with fewer threads than the host has NUMA nodes, svc_set_num_threads leaves trailing pools with zero threads. A connection that lands on such a pool is queued on sp_xprts and never serviced, so the client hangs forever rather than erroring. GPU nodes are routinely multi-socket, high-NUMA machines, which is exactly the configuration that produces empty pools; the symptom looks like a network fault and jobs block on dataset or checkpoint I/O until the mount is torn down.

Who can reach it

No authentication or attacker required in the usual case - it is a misconfiguration-triggered hang reachable by any NFS client whose connection is accepted on a CPU belonging to a threadless pool. NVD scores it as network-reachable availability loss.

What to do

Update the host kernel to a stable release carrying the svc_pool_for_cpu() fix and reboot the NFS server. Until then, the practical mitigation is to raise the nfsd thread count to at least the number of service pools (NUMA nodes or CPUs, depending on pool mode) or switch the pool mode to global - both are runtime changes on the server, no reboot needed.

References

Related entries

• Linux kernel nfsd: broken short-write detection writes the next segment at the wrong file offsetCVE-2026-89678 · Linux kernel nfsd_direct_write() (NFS server direct-I/O write path)High
• Linux kernel nfsd: NFSv4 SETATTR with the special ONE stateid NULL-derefs and oopses the serverCVE-2026-89679 · Linux kernel nfsd4_setattr() (NFSv4 delegated timestamp attributes)High
• Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mountCVE-2026-89680 · Linux kernel nfsd4_copy() (inter-server COPY setup error path)High
• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High
• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High