NFSD: Fix infinite loop in layout state revocation
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.
02 / AFFECTED SOFTWARE
Affected packages
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.
05 / REFERENCES
Further evidence
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605
- https://git.kernel.org/stable/c/4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1
- https://git.kernel.org/stable/c/d1fc00ec02e9deb3f8d2bd59caf938c554fbc576
- https://git.kernel.org/stable/c/fe59ae27d7346245f5d8d97220f374e63efd28b5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64519.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64519