CVE-2026-90234
Description
A flaw was found in the Linux kernel's Network File System (NFS) client. When an NFS server grants a delegation, the client may fail to record it and not send a DELEGRETURN message. This can lead to a situation where the server believes the client still holds the delegation. If the server then recalls this delegation, the client's state manager can enter an infinite loop, resulting in a denial of service (DoS) condition for the client.
Statement
An NFSv4 client can drop a server granted delegation without recording it locally and without returning it with DELEGRETURN. If the server later recalls that delegation, the client has no matching stateid and may answer CB_RECALL with NFS4ERR_BADHANDLE, which can leave revoked delegation state visible in later SEQUENCE replies. The client state manager can then loop over TEST_STATEID recovery and fail to clear the condition, causing denial of service or persistent degradation for affected NFS mounts. For the CVSS the PR:N is used because the attacker does not need privileges on the victim when acting as a malicious or compromised NFS server already used by the client. The issue is network reachable in NFSv4 deployments but normally requires access to the storage network or control of a trusted NFS server. Impact is availability only. No direct memory corruption or privilege escalation primitive is indicated by the patch context.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.1 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
