Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitely

Impact

The grace-period deadline is computed from nn->boot_time (CLOCK_REALTIME) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME), so the comparison never becomes true short of about 54 years of uptime. The escape hatch that is supposed to end a stuck grace period is therefore dead code, and a single client sending CLAIM_PREVIOUS OPEN requests can keep the server in grace forever, blocking all non-reclaim operations for every other client. On a shared GPU cluster that is one tenant freezing everyone else's dataset and checkpoint I/O after any server restart, with no way out but another restart.

Who can reach it

Any NFSv4 client permitted to mount the export, after a server reboot or restart - it only has to keep issuing CLAIM_PREVIOUS OPENs. Authentication is whatever the export requires; no elevated privilege.

What to do

Update the host kernel to a stable release that adds the CLOCK_BOOTTIME boot_time_bt and uses it for the deadline, then reboot the NFS server. There is no runtime knob that restores the timeout; restarting nfsd only restarts the grace period.

References

Related entries

• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux nvmet-tcp: unsolicited H2CData PDU double-completes a command and wedges the targetCVE-2026-89968 · Linux kernel nvmet-tcp (NVMe-oF TCP target)High
• Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone sizeCVE-2026-89971 · Linux kernel NVMe host (zoned namespace limits update)High
• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High
• Linux kernel NFSv4 client: dropped delegations leave the state manager looping on revoked stateCVE-2026-90234 · Linux kernel NFSv4 client (delegation handling in nfs_inode_set_delegation)High