CVE-2026-23050: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23050 is a deadlock vulnerability in the Linux kernel's pNFS (parallel NFS) subsystem that can cause a system hang when returning a delegation during an open() operation. The flaw was published on February 4, 2026, and affects the Linux kernel across multiple stable branches. It is classified as medium severity with an estimated CVSS category of MEDIUM (Feedly). The vulnerability was detected by multiple vulnerability scanners including Nessus and Qualys, and patches have been incorporated into downstream distributions such as Ubuntu and Oracle Enterprise Linux (Feedly).

The root cause is a deadlock condition (CWE-833: Deadlock) in the Linux kernel's pNFS layer, specifically in the pnfs_roc() function called during delegation return processing. When an NFS client performs an open() that triggers a delegation return via nfs_inode_set_delegation() → nfs_do_return_delegation() → nfs4_proc_delegreturn() → _nfs4_proc_delegreturn() → pnfs_roc(), the code waits on a bit lock that is never released, causing an indefinite hang. The issue was reported by Ben Coddington, who observed the hang in the kernel call stack showing __wait_on_bit blocking inside pnfs_roc (Feedly). Fixes were committed to multiple stable kernel branches (commits 857bf905, a316fd9d, c57387d4, d6c75aa9) (Kernel Git).

Successful triggering of this vulnerability causes the affected Linux system to hang indefinitely in the NFS client code path, resulting in a denial-of-service condition for processes attempting to open files over pNFS-enabled NFS mounts. The primary impact is on availability — the hung process cannot be interrupted normally, and depending on the workload, this can cascade to broader system instability. Confidentiality and integrity are not directly affected by this vulnerability (Feedly).

This vulnerability requires local access to a system configured with pNFS-enabled NFS mounts and is triggered by normal filesystem operations (opening a file), making it exploitable by any local user or process with access to the affected NFS mount. There is no known public exploit code, no evidence of in-the-wild exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.017%, reflecting minimal exploitation probability (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches via commits 857bf905, a316fd9d, c57387d4, and d6c75aa9 (Kernel Git). Downstream distributions have issued patched kernel packages: Ubuntu has released fixes in USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, USN-8393-1, and Oracle Enterprise Linux via advisory EL-2026-50144 (Ubuntu Security, Feedly). As a workaround, administrators can disable pNFS on affected NFS mounts (using the nfsvers=4.0 mount option or disabling pNFS server-side) until a patched kernel can be applied.