{"id":"CVE-2026-45983","title":"nfsd: never defer requests during idmap lookup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: never defer requests during idmap lookup\n\nDuring v4 request compound arg decoding, some ops (e.g. SETATTR)\ncan trigger idmap lookup upcalls. When those upcall res…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < b9abb760db20504240a7147f27934d900cd80b23","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 3a72c7dedc99b321e0f267e4e999e5baf07c4593","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 99e17b20fddac19a228d213e00f6b9e1c10daff9","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 243f71ed873ff3feeb6f9b5cb145d63f7188b4c4","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 063a6f22478ef929625000a2caf54667725c1dfd","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < d75ec4504a4340b033b15cad0303988b3089dd93","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 8dff54fe88c0dcd4c55bff9fc2fa6ca968290826","Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < f9c206cdc4266caad6a9a7f46341420a10f03ccb","Linux 2.6.30"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:03:59.629049Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:30.147Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45983","references":[{"url":"https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23"},{"url":"https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593"},{"url":"https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9"},{"url":"https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4"},{"url":"https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd"},{"url":"https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93"},{"url":"https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826"},{"url":"https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02054,"ingestedAt":"2026-11-06T16:57:43.354Z","slug":"CVE-2026-45983","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: never defer requests during idmap lookup\n\nDuring v4 request compound arg decoding, some ops (e.g. SETATTR)\ncan trigger idmap lookup upcalls. When those upcall responses get\ndelayed beyond the allowed time limit, cache_check() will mark the\nrequest for deferral and cause it to be dropped.\n\nThis prevents nfs4svc_encode_compoundres from being executed, and\nthus the session slot flag NFSD4_SLOT_INUSE never gets cleared.\nSubsequent client requests will fail with NFSERR_JUKEBOX, given\nthat the slot will be marked as in-use, making the SEQUENCE op\nfail.\n\nFix this by making sure that the RQ_USEDEFERRAL flag is always\nclear during nfs4svc_decode_compoundargs(), since no v4 request\nshould ever be deferred.\n\n## Affected\n\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < b9abb760db20504240a7147f27934d900cd80b23`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 3a72c7dedc99b321e0f267e4e999e5baf07c4593`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 99e17b20fddac19a228d213e00f6b9e1c10daff9`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 243f71ed873ff3feeb6f9b5cb145d63f7188b4c4`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 063a6f22478ef929625000a2caf54667725c1dfd`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < d75ec4504a4340b033b15cad0303988b3089dd93`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < 8dff54fe88c0dcd4c55bff9fc2fa6ca968290826`\n- `Linux >= 2f425878b6a71571341dcd3f9e9d1a6f6355da9c < f9c206cdc4266caad6a9a7f46341420a10f03ccb`\n- `Linux 2.6.30`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}