Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips… (CVE-2026-64519)
A vulnerability in the Linux kernel's NFS server daemon (NFSD) caused an infinite loop during layout state revocation due to improper handling of state IDs (stids). This flaw was fixed in Linux kernel versions 7.0.0 and later. The issue could cause the revoker to hang indefinitely, impacting system stability. The vulnerability is rated medium severity. Multiple Linux kernel subsystems had security issues fixed in the same update. Users should update to the fixed kernel versions to resolve this and other vulnerabilities.
AI Analysis
Technical Summary
CVE-2026-64519 addresses an infinite loop vulnerability in the Linux kernel's NFSD component. The function find_one_sb_stid() skips stids with non-zero sc_status, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() does not set sc_status before calling nfsd4_close_layout(). This causes the retry loop to repeatedly find the same layout stid, resulting in an indefinite hang of the revoker. The issue was resolved by correcting this logic. The fix is included in Linux kernel versions 7.0.0 and later, as distributed by Ubuntu in various kernel packages. This vulnerability is part of a broader set of Linux kernel security fixes released in July and August 2026.
Potential Impact
The vulnerability causes the NFS server daemon's layout state revocation process to enter an infinite loop, hanging the revoker indefinitely. This can lead to denial of service conditions affecting system stability and availability. No known exploits are reported in the wild. The issue does not directly lead to privilege escalation or data corruption but impacts kernel reliability during NFS operations.
Mitigation Recommendations
A patch is available and included in Linux kernel versions 7.0.0 and later. Users should update their Linux kernel packages to the fixed versions as provided by their distribution vendor, such as Ubuntu's linux-image packages version 7.0.0-28.28 and later. After updating, a system reboot is required to apply the fix. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. No additional mitigation steps are necessary beyond applying the official update.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips… (CVE-2026-64519)
Description
A vulnerability in the Linux kernel's NFS server daemon (NFSD) caused an infinite loop during layout state revocation due to improper handling of state IDs (stids). This flaw was fixed in Linux kernel versions 7.0.0 and later. The issue could cause the revoker to hang indefinitely, impacting system stability. The vulnerability is rated medium severity. Multiple Linux kernel subsystems had security issues fixed in the same update. Users should update to the fixed kernel versions to resolve this and other vulnerabilities.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64519 addresses an infinite loop vulnerability in the Linux kernel's NFSD component. The function find_one_sb_stid() skips stids with non-zero sc_status, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() does not set sc_status before calling nfsd4_close_layout(). This causes the retry loop to repeatedly find the same layout stid, resulting in an indefinite hang of the revoker. The issue was resolved by correcting this logic. The fix is included in Linux kernel versions 7.0.0 and later, as distributed by Ubuntu in various kernel packages. This vulnerability is part of a broader set of Linux kernel security fixes released in July and August 2026.
Potential Impact
The vulnerability causes the NFS server daemon's layout state revocation process to enter an infinite loop, hanging the revoker indefinitely. This can lead to denial of service conditions affecting system stability and availability. No known exploits are reported in the wild. The issue does not directly lead to privilege escalation or data corruption but impacts kernel reliability during NFS operations.
Mitigation Recommendations
A patch is available and included in Linux kernel versions 7.0.0 and later. Users should update their Linux kernel packages to the fixed versions as provided by their distribution vendor, such as Ubuntu's linux-image packages version 7.0.0-28.28 and later. After updating, a system reboot is required to apply the fix. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. No additional mitigation steps are necessary beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gv69-m9qg-32px
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64519"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542059c2644c7f8081acf
Added to database: 07/25/2026, 23:08:53 UTC
Last enriched: 09/07/2026, 17:35:27 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.