CVE-2026-46256 Linux NFS LOCALIO Recursion Deadlock Vulnerability

Technical summary

CVE-2026-46256 describes a potential deadlock in the Linux kernel's NFS LOCALIO implementation (CWE-667: improper locking). LOCALIO eliminates network overhead for NFS READ, WRITE, and COMMIT operations when both client and server reside on the same host. However, under direct memory reclaim pressure, the page cache allocation path can recursively re-enter NFS via nfs_writepages, creating a circular wait condition. The vulnerability arises because LOCALIO's memory allocation context was not restricted to prevent this recursion. The fix applies GFP_NOFS (No Filesystem) flags to relevant allocation sites, ensuring the reclaim path cannot trigger additional NFS I/O that would deadlock waiting on already-held locks.

Business impact

Systems relying on NFS LOCALIO for local storage optimization may experience kernel hangs under memory pressure, leading to service unavailability. This is particularly concerning in containerized or virtualized environments where loopback NFS is used for performance and the host experiences memory contention. Affected workloads would experience sudden, unresponsive systems requiring intervention. Organizations deploying LOCALIO should prioritize patching to maintain availability, especially in production environments with variable memory demand.

Affected systems

The Linux kernel with LOCALIO enabled. This feature is typically enabled in modern distributions (kernel 5.13+) but requires explicit NFS mount options (e.g., loopback) or kernel configuration to activate. Servers performing NFS operations locally are the primary targets. The vulnerability requires local process context to trigger direct reclaim, so remote attackers cannot exploit it directly.

Exploitability

Exploitation requires local access to trigger direct memory reclaim under the vulnerable kernel's LOCALIO code path. An unprivileged local user can indirectly trigger this via memory-intensive workloads that force reclaim, causing the kernel to hang. No network access, user interaction, or elevated privileges are strictly required, though the impact manifests as a denial of service affecting all users on the system. CVSS 5.5 (MEDIUM) reflects local attack vector, low complexity, and availability impact without confidentiality or integrity loss. This is not currently tracked in CISA's KEV catalog, indicating no evidence of active exploitation in the wild.

Remediation

Apply the kernel patch that restricts LOCALIO page cache allocations to GFP_NOFS context, preventing direct reclaim from re-entering NFS. This fix has been merged into upstream Linux kernel development. End users should update to a patched kernel version provided by their Linux distribution. Verify the exact patched version against your vendor's advisory, as release cadences vary.

Patch guidance

Consult your Linux distribution's security advisories for the patched kernel version (e.g., Red Hat, Canonical, SUSE). Most distributions will backport the fix into stable branches. On systems where kernel updates are constrained, consider disabling LOCALIO (if enabled explicitly in mount options) as a temporary mitigation. Typical patching involves kernel package updates followed by reboot; test in non-production environments first to ensure compatibility with local NFS configurations.

Detection guidance

Monitor for kernel warnings or oops messages referencing NFS, page cache reclaim, or locking timeouts in dmesg logs, particularly on systems using NFS mounts with loopback options. System responsiveness issues under memory pressure combined with NFS workloads may signal exposure. Review kernel version via 'uname -r' to determine if running an affected build; compare against vendor-provided patch release notes. Kernel tracing (e.g., ftrace) can capture the recursion pattern if needed for forensics.

Why prioritize this

While CVSS 5.5 places this in MEDIUM severity, organizations heavily dependent on NFS LOCALIO for local I/O optimization should prioritize patching to prevent availability disruptions. The attack surface is narrow (requires local access and memory contention) but the impact—kernel hang—is severe for availability. Patch as soon as your distribution provides a release, especially in production environments where memory usage is variable.

Risk score, explained

CVSS 3.1 score of 5.5 reflects: Attack Vector Local (not remotely exploitable), Attack Complexity Low (direct reclaim is a normal kernel function), Privileges Required (local user sufficient), no User Interaction, no Scope change, and high Availability impact (system hang). Confidentiality and Integrity are unaffected. The score appropriately reflects a local denial-of-service risk with moderate severity.

Frequently asked questions