In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix clock domain mismatch in clients still reclaiming()

clients still reclaiming() computes a deadline from nn->boot time (CLOCK REALTIME, ~1.7 billion) but compares it against ktime get boottime seconds() (CLOCK BOOTTIME, seconds since boot). The comparison is always false — it would take ~54 years of uptime for BOOTTIME to exceed the REALTIME-derived deadline.

This means any client can hold the server in grace indefinitely by sending CLAIM PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients.

Add boot time bt (CLOCK BOOTTIME) alongside the existing boot time and use it for the deadline computation. boot time (CLOCK REALTIME) is preserved for its cl boot clientid-nonce role.