Resolved -
A KernelCare adaptation of the CVE-2025-39697 NFS patch introduced a locking regression. Specifically, the patch caused the same spinlock to be acquired twice within a single execution path:
- nfs_page_group_lock
- nfs_page_group_sync_on_bit
This resulted in a deadlock that left kernel threads stuck in the D state. Once triggered, the patch could not be safely unloaded, and affected systems either froze indefinitely or rebooted due to hung task watchdogs.
Why this happened:
The issue was caused by a non-trivial adaptation of the upstream NFS CVE fix rather than a direct backport. This adaptation significantly altered the runtime execution flow and locking behavior in NFS write paths, introducing a double acquisition of the same spinlock under active NFS workloads.
The deadlock only manifested at runtime when NFS client activity was present after the live patch was applied, which made the issue difficult to detect through static code review alone.
We apologize for the inconvenience. A fixed patchset is now available across all feeds.
We also checked with our development team for alternatives to rebooting systems where NFS processes are already stuck. Unfortunately, a reboot remains the only viable recovery option in this scenario.
If no processes are present in the D state, patching should proceed normally.
Jan 27, 11:49 UTC
Monitoring -
The fixed patches are now available in the main feed. Root Cause Analysis will be available soon.
Jan 26, 10:44 UTC
Identified -
The core issue was identified and fixed. New patches are currently available in the testing feed. More updates will be provided soon.
Jan 23, 09:35 UTC
Update -
We've established that enterprise users that are using ePortal - are not affected by this incident.
Jan 21, 12:21 UTC
Investigating -
We have received at least 3 tickets about NFS-related issues in CL8.
We have blocked the most recent CL8 release, and we're going to do it for all recent EL8 distros.
We're currently trying to identify the full scope, so more release rollbacks may be required.
Please do not try to forcibly unapply patches, if possible.
Jan 21, 12:11 UTC