Answer in brief
CVE-2026-45983 records a Unknown severity vulnerability in nfsd: never defer requests during idmap lookup. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <b9abb760db20504240a7147f27934d900cd80b23 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <3a72c7dedc99b321e0f267e4e999e5baf07c4593 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <99e17b20fddac19a228d213e00f6b9e1c10daff9 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <243f71ed873ff3feeb6f9b5cb145d63f7188b4c4 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <063a6f22478ef929625000a2caf54667725c1dfd || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <d75ec4504a4340b033b15cad0303988b3089dd93 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <8dff54fe88c0dcd4c55bff9fc2fa6ca968290826 || >=2f425878b6a71571341dcd3f9e9d1a6f6355da9c <f9c206cdc4266caad6a9a7f46341420a10f03ccb | b9abb760db20504240a7147f27934d900cd80b23, 3a72c7dedc99b321e0f267e4e999e5baf07c4593, 99e17b20fddac19a228d213e00f6b9e1c10daff9, 243f71ed873ff3feeb6f9b5cb145d63f7188b4c4, 063a6f22478ef929625000a2caf54667725c1dfd, d75ec4504a4340b033b15cad0303988b3089dd93, 8dff54fe88c0dcd4c55bff9fc2fa6ca968290826, f9c206cdc4266caad6a9a7f46341420a10f03ccb |
| Linux/Linuxgeneric | 2.6.30 | Not reported |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyond the allowed time limit, cache_check() will mark the request for deferral and cause it to be dropped. This prevents nfs4svc_encode_compoundres from being executed, and thus the session slot flag NFSD4_SLOT_INUSE never gets cleared. Subsequent client requests will fail with NFSERR_JUKEBOX, given that the slot will be marked as in-use, making the SEQUENCE op fail. Fix this by making sure that the RQ_USEDEFERRAL flag is always clear during nfs4svc_decode_compoundargs(), since no v4 request should ever be deferred.
Quoted source text, attributed separately from HOL analysis.