CVE-2026-46256

NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

MEDIUM
5.5
CVSS Score
Published: June 3, 2026 at 03:49 PM UTC
Updated: October 21, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages LOCALIO is an NFS loopback mount optimization that avoids using the network for READ, WRITE and COMMIT if the NFS client and server are determined to be on the same system. But because LOCALIO is still fundamentally "just NFS loopback mount" it is susceptible to recursion deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then back into NFS via nfs_writepages. Fix LOCALIO's potential for direct reclaim deadlock by ensuring that all its page cache allocations are done from GFP_NOFS context. Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation").

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.12 ≤ v < 6.18.146.19 ≤ v < 6.19.46.1270ba381e1a431245c137ed597ec6a05991c79bd9
Vendor states this is fixed in 67435d2d8a33a75f9647724952cb1b18279d2e95 (fixed)
Vendor states this is fixed in 6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9 (fixed)
Vendor states this is fixed in ae26a4cf2baf0a44c538dc093504d1994b02dade (fixed)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.18.14 (unaffected)
Vendor states this is fixed in 6.19.4 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card