LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio()

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The latter cannot make progress due to state recovery being needed. It seems that the only safe thing to do here is to kick off a writeback of the folio, without waiting for completion, or else kicking off an asynchronous commit.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23053 is a Linux kernel NFS issue that can cause a deadlock during NFSv4.1 state recovery and memory reclaim. In practical terms, affected systems using NFS may hang or become unavailable. Public sources do not provide a CVSS score, confirmed exploitation, or broader impact details.

Executive priority

Treat as a targeted availability risk for Linux systems that rely on NFS. Prioritize patch planning for business-critical NFS clients, but do not escalate as an actively exploited emergency based on current public evidence.

Technical view

The resolved bug involves nfs_release_folio() blocking during reclaim while NFSv4.1 state recovery is waiting on kthreadd. The kernel fix avoids waiting synchronously by starting writeback or an asynchronous commit. The issue appears availability-focused, but public data is limited.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds that use NFS, especially NFSv4.1. The provided record lists Linux kernel versions including 6.3, 6.6.130, 6.12.67, 6.18.7, and 6.19 as affected, but distribution-specific backports are not identified.

Exploitation context

No public source in the provided bundle reports active exploitation, weaponized proof of concept, or CISA KEV listing. The known trigger context is kernel behavior during NFSv4.1 state recovery and memory reclaim, suggesting operational availability risk rather than direct remote code execution evidence.

Researcher notes

The CVE record lacks CVSS, CWE, and detailed affected-version semantics. The source describes a resolved Linux kernel deadlock and references four stable commits. Further validation should use kernel commit history and downstream vendor advisories to map exact exposure.

Mitigation direction

  • Review Linux distribution advisories for CVE-2026-23053 and matching kernel packages.
  • Update to a kernel containing the referenced stable fixes when available for your platform.
  • Prioritize systems that depend on NFS for production workloads.
  • Where patching is delayed, monitor NFS clients for hangs or recovery failures.

Validation and detection

  • Inventory Linux kernel versions across NFS client systems.
  • Identify hosts using NFSv4.1 or production NFS mounts.
  • Confirm whether vendor kernels include the referenced stable commits or backports.
  • Review incident telemetry for unexplained NFS-related hangs or deadlocks.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23053 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux96780ca55e3cbf4f150fd5a833a61492c9947b5b, 96780ca55e3cbf4f150fd5a833a61492c9947b5b, 96780ca55e3cbf4f150fd5a833a61492c9947b5b, 96780ca55e3cbf4f150fd5a833a61492c9947b5bunaffected
LinuxLinux6.3, 0, 6.6.130, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.