CVE-2026-23050: pNFS: Fix a deadlock when returning a delegation during open()
Vulnerability summary
CVE-2026-23050 is a high (CVSS 8.2) vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 10% of scored vulnerabilities.
Severe, CVSS 8.2 (OSV · Ubuntu); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 19Timeline
- 04-02-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given. The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu156 products
- linuxAll versions (No fix recorded) | < 6.8.0-117.117
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1055.58
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.69-1 | < 6.18.8-1
Linux1 product
- linux≥ 29ade5db12930ec60133f6a02791f4b1a4af2943, < 05a685b38dbca489d5f21eac9e7f20959344076a | ≥ 29ade5db12930ec60133f6a02791f4b1a4af2943, < c57387d447a2bcbaea009ba5f9497adf3de5edeb | ≥ 29ade5db12930ec60133f6a02791f4b1a4af2943, < a316fd9d3065b753b03d802530004aea481512cc | ≥ 29ade5db12930ec60133f6a02791f4b1a4af2943, < d6c75aa9d607044d1e5c8498eff0259eed356c32 | ≥ 29ade5db12930ec60133f6a02791f4b1a4af2943, < 857bf9056291a16785ae3be1d291026b2437fc48 | 4.10
3 vendors · 158 products
