CVE-2026-93221
📛 CVE Title
nfsd: convert nfsd_net boolean flags to unsigned long flags word
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool: if (nn->grace_ended) return; nn->grace_ended = true; The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held: laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace() RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace() Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory. A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above. Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- HIGH
- CVSS score
- 8.1 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.1 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- 2026-09-17
- Published
- 2026-09-24 15:10 UTC
- Last updated
- 2026-09-25 05:09 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93221.json
- Linked Threat
- CVE-2026-93221 — nfsd: convert nfsd_net boolean flags to unsigned long flags word
NVD / KEV / EPSS data refreshed 2026-09-25 04:31 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85950 - Assigner
- Linux
- Published
- Sep 24, 2026, 3:10:44 PM
- Updated
- Sep 25, 2026, 5:09:44 AM
- EUVD base score (CVSS 3.1)
-
8.1 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0000
- Vendors
- Linux
- Products
-
Linux (patch: 7.3-rc1)Linux (362063a595be959bc08f4163e6405a0266740091 <df5922fe09a8131c793ffa86adf204999b0470f8)Linux (5.2)Linux (patch: 0)Linux (patch: 7.2.4)Linux (362063a595be959bc08f4163e6405a0266740091 <11a5fe42e1811f793e04ef885b639ea7668f439d)
- Aliases
-
GHSA-r3mg-g23p-86c9
ENISA description: In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool: if (nn->grace_ended) return; nn->grace_ended = true; The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held: laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace() RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace() Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory. A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above. Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
362063a595be959bc08f4163e6405a0266740091 (affected),
362063a595be959bc08f4163e6405a0266740091 (affected)
|
— |
| Linux | Linux |
5.2 (affected),
0 (unaffected),
7.2.4 (unaffected),
7.3-rc1 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (15)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.qualys.com
The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services.
2026-09-25 10:45 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-25 10:45 UTC -
web:helpx.adobe.com
This page contains important information regarding security vulnerabilities that could affect specific versions of Adobe products. Use this information to take the prescribed corrective actions.
2026-09-25 10:45 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-25 10:45 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 10:45 UTC -
web:securityboulevard.com
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments.Key TakeawaysCISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities ( CVE - 2026 -32201, CVE - 2026 -45659, CVE - 2026 -56164), used ...
2026-09-25 10:45 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-09-25 10:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:45 UTC -
web:www.oracle.com
Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...
2026-09-25 10:45 UTC -
web:www.tenable.com
CISA confirmed exploitation of three SharePoint Server CVEs . Patches, AMSI IoCs, and details on CVE - 2026 -32201, CVE - 2026 -45659, CVE - 2026 -56164.
2026-09-25 10:45 UTC -
web:my.f5.com
On September 2, 2026 , F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles.
2026-09-25 15:07 UTC -
web:www.action1.com
This CISO-focused summary highlights the vulnerabilities and critical infrastructure risks that should take priority for remediation following Microsoft's September 2026 Patch Tuesday release.
2026-09-25 15:07 UTC -
web:www.malwarebytes.com
Microsoft's August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges. The August update is smaller than July's record-breaking release, but it's still ...
2026-09-25 15:07 UTC -
web:www.sentinelone.com
CVE - 2026 -32202 is an authentication bypass vulnerability in Windows Shell. Learn about its impact, affected versions, and mitigation methods.
2026-09-25 15:07 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-09-25 15:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-93221.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/netns.h",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4recover.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c",
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "df5922fe09a8131c793ffa86adf204999b0470f8",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
},
{
"lessThan": "11a5fe42e1811f793e04ef885b639ea7668f439d",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/netns.h",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4recover.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c",
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization. In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n if (nn->grace_ended)\n return;\n nn->grace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them. At least two contexts can reach this\ncode with no lock held:\n\n laundromat path\n laundry_wq kworker\n nfs4_laundromat()\n nfsd4_end_grace()\n\n RECLAIM_COMPLETE path\n nfsd compound kthread\n nfsd4_reclaim_complete()\n inc_reclaim_complete()\n nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops->grace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry. Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat's first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions. The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures. The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency. This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd4_end_grace() is reached from a remote NFSv4.1 RECLAIM_COMPLETE: svc_recv to nfsd_dispatch to nfsd4_proc_compound to nfsd4_sequence (sets cstate->clp) to nfsd4_reclaim_complete to inc_reclaim_complete to nfsd4_end_grace on TCP/2049. That RECLAIM_COMPLETE compound is the attacker-supplied protocol message.\nAC:H - The other nfsd4_end_grace() caller is nfs4_laundromat() on laundry_wq, queued in nfs4_state_start_net() for nn->nfsd4_grace seconds. A peer cannot start that work (nfsd4_force_end_grace is only write_v4_end_grace). Both must see grace_ended==false, which needs an already-running grace with a non-empty reclaim_str_hashtbl the attacker cannot create on demand.\nPR:N - Typical nfsd exports accept AUTH_SYS, so the client only asserts a uid. nfsd4_exchange_id() with SP4_NONE and nfsd4_create_session() are ALLOWED_AS_FIRST_OP without a filehandle, and OP_RECLAIM_COMPLETE is ALLOWED_WITHOUT_FH, so no fh_verify, share access, or Kerberos is required.\nUI:N - The attacker sends EXCHANGE_ID, CREATE_SESSION, SEQUENCE, and RECLAIM_COMPLETE on their own session. No write to v4_end_grace, mount, or other victim action is required.\nS:U - Concurrent nfs4_release_reclaim() list_del/kfree of nfs4_client_reclaim entries corrupts heap inside the host nfsd kernel. That stays in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - When two nfsd4_end_grace() callers both run nfsd4_record_grace_done() (nfsd4_cld_grace_done or nfsd4_recdir_purge_old), nfs4_release_reclaim() double-frees every nfs4_client_reclaim while nfsd4_find_reclaim_client() walks the same unlocked cr_strhash bucket through freed objects, a UAF read primitive.\nI:H - nfs4_remove_reclaim_record() does unlocked list_del(&crp->cr_strhash) then kfree on each nfs4_client_reclaim. Two concurrent walkers corrupt adjacent list pointers (unlink write) and double-free the slab objects, which is an arbitrary kernel write.\nA:H - The same unlocked list_del/kfree in nfs4_release_reclaim(), or nfsd4_find_reclaim_client() following a freed cr_strhash, oopses the host kernel (poisoned list pointers or double-free of nfs4_client_reclaim), a full availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T05:09:44.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8"
},
{
"url": "https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"
}
],
"title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93221",
"datePublished": "2026-09-24T15:10:44.598Z",
"dateReserved": "2026-09-17T16:02:15.094Z",
"dateUpdated": "2026-09-25T05:09:44.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}