Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitely

Impact

The grace-period deadline is computed from nn->boot_time (CLOCK_REALTIME) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME), so the comparison never becomes true short of about 54 years of uptime. The escape hatch that is supposed to end a stuck grace period is therefore dead code, and a single client sending CLAIM_PREVIOUS OPEN requests can keep the server in grace forever, blocking all non-reclaim operations for every other client. On a shared GPU cluster that is one tenant freezing everyone else's dataset and checkpoint I/O after any server restart, with no way out but another restart.

Who can reach it

Any NFSv4 client permitted to mount the export, after a server reboot or restart - it only has to keep issuing CLAIM_PREVIOUS OPENs. Authentication is whatever the export requires; no elevated privilege.

What to do

Update the host kernel to a stable release that adds the CLOCK_BOOTTIME boot_time_bt and uses it for the deadline, then reboot the NFS server. There is no runtime knob that restores the timeout; restarting nfsd only restarts the grace period.

References

Related entries

• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High