In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming()… (CVE-2026-89685)
A vulnerability in the Linux kernel's NFS server (nfsd) involving a clock domain mismatch in the clients_still_reclaiming() function has been resolved. The function incorrectly compares a deadline computed using CLOCK_REALTIME against a timestamp from CLOCK_BOOTTIME, causing the comparison to always fail. This flaw allows any client to indefinitely hold the server in grace period by sending CLAIM_PREVIOUS OPEN requests, thereby blocking non-reclaim operations for other clients.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-89685 involves the nfsd subsystem where clients_still_reclaiming() computes a deadline based on nn->boot_time using CLOCK_REALTIME but compares it against ktime_get_boottime_seconds() which uses CLOCK_BOOTTIME. Because these clock domains differ, the comparison is always false, effectively allowing clients to hold the server in grace indefinitely via CLAIM_PREVIOUS OPEN requests. The fix introduces a new boot_time_bt variable using CLOCK_BOOTTIME for deadline computation while preserving the original boot_time for clientid-nonce purposes.
Potential Impact
An attacker controlling an NFS client can exploit this vulnerability to indefinitely block all non-reclaim operations for other clients by continuously sending CLAIM_PREVIOUS OPEN requests. This results in a denial of service condition affecting all other clients connected to the NFS server.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by correcting the clock domain mismatch. Users and administrators should apply the official kernel updates that include this patch to remediate the vulnerability.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming()… (CVE-2026-89685)
Description
A vulnerability in the Linux kernel's NFS server (nfsd) involving a clock domain mismatch in the clients_still_reclaiming() function has been resolved. The function incorrectly compares a deadline computed using CLOCK_REALTIME against a timestamp from CLOCK_BOOTTIME, causing the comparison to always fail. This flaw allows any client to indefinitely hold the server in grace period by sending CLAIM_PREVIOUS OPEN requests, thereby blocking non-reclaim operations for other clients.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-89685 involves the nfsd subsystem where clients_still_reclaiming() computes a deadline based on nn->boot_time using CLOCK_REALTIME but compares it against ktime_get_boottime_seconds() which uses CLOCK_BOOTTIME. Because these clock domains differ, the comparison is always false, effectively allowing clients to hold the server in grace indefinitely via CLAIM_PREVIOUS OPEN requests. The fix introduces a new boot_time_bt variable using CLOCK_BOOTTIME for deadline computation while preserving the original boot_time for clientid-nonce purposes.
Potential Impact
An attacker controlling an NFS client can exploit this vulnerability to indefinitely block all non-reclaim operations for other clients by continuously sending CLAIM_PREVIOUS OPEN requests. This results in a denial of service condition affecting all other clients connected to the NFS server.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by correcting the clock domain mismatch. Users and administrators should apply the official kernel updates that include this patch to remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3574-3v33-rcrf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89685"]
Threat ID: 6aa4a00255bf5e2cf5a86619
Added to database: 09/12/2026, 00:42:42 UTC
Last enriched: 09/12/2026, 00:55:56 UTC
Last updated: 09/12/2026, 00:55:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.