CVE-2026-23053: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23053 is a deadlock vulnerability in the Linux kernel's NFS (Network File System) subsystem, specifically involving the nfs_release_folio() function. The flaw was reported by Wang Zhaolong and occurs when NFSv4.1 state recovery waits on kthreadd, which simultaneously attempts to reclaim memory by calling nfs_release_folio() — a function that cannot make progress because state recovery is still pending, creating a circular dependency. The vulnerability was published on February 4, 2026, and affects Linux kernel versions starting from 6.3 up to the patched stable releases (Feedly, ENISA EUVD). The CVSS base score is estimated as Medium severity (Feedly).

The root cause is a deadlock condition (CWE-833: Deadlock) in the Linux kernel's NFS client implementation. When the system is under memory pressure, kthreadd invokes nfs_release_folio() to reclaim memory from NFS-backed pages; however, this function requires NFSv4.1 state recovery to have completed, while state recovery itself is blocked waiting on kthreadd, forming a circular wait. The fix involves initiating an asynchronous writeback of the folio or kicking off an asynchronous commit — avoiding any blocking wait that would perpetuate the deadlock. The vulnerability is introduced at commit 96780ca55e3cbf4f150fd5a833a61492c9947b5b and is resolved in multiple stable branches (Feedly, ENISA EUVD).

Successful triggering of this vulnerability results in a kernel deadlock, causing the affected system to hang or become unresponsive — a denial of service (DoS) condition. Systems using NFSv4.1 mounts under memory pressure are at risk, as the deadlock prevents both memory reclamation and NFS state recovery from completing. There is no known confidentiality or integrity impact; the primary consequence is loss of availability for the affected host (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.12.67, 6.18.7, and 6.19-rc6 (ENISA EUVD). Downstream distributions including Ubuntu (USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, USN-8393-1), SUSE (SUSE-2026-0962-1), Oracle Enterprise Linux, and Red Hat have also issued advisories and updated packages (Ubuntu Advisory, Feedly). Administrators should update to the patched kernel version provided by their distribution as soon as possible; no configuration-based workaround is known.