CVE-2026-93231

Description

In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvc_match_ip() When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip, nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server sockaddr as the opaque @data argument: nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL); The match callback is later invoked from nlm_traverse_locks() as: match(lockhost, host); where the first argument is the nlm_host that owns the lock, and the second argument is the @data that was originally passed down (here the server sockaddr). This is the convention every other match callback relies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()): arg1 is the real nlm_host, arg2 is the caller-supplied reference value. nlmsvc_match_ip() has had these two arguments reversed ever since the unlock-by-IP feature was introduced in commit 4373ea84c84d ("lockd: unlock lockd locks associated with a given server ip"): return rpc_cmp_addr(nlm_srcaddr(host), datap); Here @host is actually the server sockaddr, so nlm_srcaddr(host) dereferences a struct sockaddr as a struct nlm_host and reads garbage at the offset of h_srcaddr; meanwhile @datap is actually the lock owner's nlm_host but is compared as a sockaddr. As a result the comparison practically never matches and locks are not released for the requested IP. Swap the arguments so the lock owner's source address is compared against the requested server address: return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host); [ cel: fix the misleading typedef parameter names too ]

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: —
CVSS score: —
CVSS vector: —
Effective score: no score available from CNA, NVD, or AI yet
CWE(s): —
Reserved: 2026-09-17
Published: 2026-09-24 15:29 UTC
Last updated: 2026-09-24 15:29 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93231.json

AI-forensic CVSS estimate

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-86236
Assigner: Linux
Published: Sep 24, 2026, 3:29:19 PM
Updated: Sep 24, 2026, 3:29:19 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0000
Vendors: Linux
Products: Linux (2.6.26)

Linux (4373ea84c84d8a96e99d3da99e813d3e36d1bd11 <b9060689f49dc663e9a3d069c4a65ff63a836e66)

Linux (4373ea84c84d8a96e99d3da99e813d3e36d1bd11 <0d72e78c9d38d5377a059a4837f82b65b91cdcf6)

Linux (patch: 6.18.51)

Linux (patch: 7.3-rc1)

Linux (4373ea84c84d8a96e99d3da99e813d3e36d1bd11 <21bcb609e0ab1dd60f39ca3498f85808933bcc9f)

Linux (patch: 0)

Linux (patch: 7.2.4)
Aliases: GHSA-hmpj-ph58-cxj3

ENISA description: In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvc_match_ip() When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip, nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server sockaddr as the opaque @data argument: nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL); The match callback is later invoked from nlm_traverse_locks() as: match(lockhost, host); where the first argument is the nlm_host that owns the lock, and the second argument is the @data that was originally passed down (here the server sockaddr). This is the convention every other match callback relies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()): arg1 is the real nlm_host, arg2 is the caller-supplied reference value. nlmsvc_match_ip() has had these two arguments reversed ever since the unlock-by-IP feature was introduced in commit 4373ea84c84d ("lockd: unlock lockd locks associated with a given server ip"): return rpc_cmp_addr(nlm_srcaddr(host), datap); Here @host is actually the server sockaddr, so nlm_srcaddr(host) dereferences a struct sockaddr as a struct nlm_host and reads garbage at the offset of h_srcaddr; meanwhile @datap is actually the lock owner's nlm_host but is compared as a sockaddr. As a result the comparison practically never matches and locks are not released for the requested IP. Swap the arguments so the lock owner's source address is compared against the requested server address: return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host); [ cel: fix the misleading typedef parameter names too ]

EUVD references (3)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`4373ea84c84d8a96e99d3da99e813d3e36d1bd11` (affected), `4373ea84c84d8a96e99d3da99e813d3e36d1bd11` (affected), `4373ea84c84d8a96e99d3da99e813d3e36d1bd11` (affected)	—
Linux	Linux	`2.6.26` (affected), `0` (unaffected), `6.18.51` (unaffected), `7.2.4` (unaffected), `7.3-rc1` (unaffected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

September 2026 Patch Tuesday: 9 Critical CVEs — Patch Now

web:byteiota.com

Microsoft's September 2026 Patch Tuesday fixes 9 vulnerabilities — all of them Critical. On paper, that sounds manageable after August's 421- CVE pile-up. In practice, one of these nine was already being exploited in the wild before the patch shipped.

2026-09-25 10:45 UTC
CVE-2026-93231: Linux Vulnerability - CVETodo

web:cvetodo.com

CVE-2026-93231 vulnerability details and analysis. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-25 10:45 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:45 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.

2026-09-25 10:45 UTC
2026 Catalog Release History - Patch My PC

web:patchmypc.com

You can find the production release history below for 2026 .

2026-09-25 10:45 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-25 10:45 UTC
Critical Patches Issued for Microsoft Products, September 8, 2026

web:www.cisecurity.org

<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

2026-09-25 10:45 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-25 10:45 UTC
CVE-2026-72931: Missing Release of Resource after Effective Lifetime

web:www.rapid7.com

CVE - 2026 -72931: Missing Release of Resource after Effective Lifetime. View severity, references, and remediation details from Rapid7.

2026-09-25 10:45 UTC
Patch Tuesday September 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-09-25 10:45 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-93231.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/lockd.h",
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d72e78c9d38d5377a059a4837f82b65b91cdcf6",
              "status": "affected",
              "version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
              "versionType": "git"
            },
            {
              "lessThan": "21bcb609e0ab1dd60f39ca3498f85808933bcc9f",
              "status": "affected",
              "version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
              "versionType": "git"
            },
            {
              "lessThan": "b9060689f49dc663e9a3d069c4a65ff63a836e66",
              "status": "affected",
              "version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/lockd.h",
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix swapped arguments in nlmsvc_match_ip()\n\nWhen releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,\nnlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server\nsockaddr as the opaque @data argument:\n\n\tnlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);\n\nThe match callback is later invoked from nlm_traverse_locks() as:\n\n\tmatch(lockhost, host);\n\nwhere the first argument is the nlm_host that owns the lock, and the\nsecond argument is the @data that was originally passed down (here the\nserver sockaddr).  This is the convention every other match callback\nrelies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):\narg1 is the real nlm_host, arg2 is the caller-supplied reference value.\n\nnlmsvc_match_ip() has had these two arguments reversed ever since the\nunlock-by-IP feature was introduced in commit 4373ea84c84d (\"lockd:\nunlock lockd locks associated with a given server ip\"):\n\n\treturn rpc_cmp_addr(nlm_srcaddr(host), datap);\n\nHere @host is actually the server sockaddr, so nlm_srcaddr(host)\ndereferences a struct sockaddr as a struct nlm_host and reads garbage\nat the offset of h_srcaddr; meanwhile @datap is actually the lock\nowner's nlm_host but is compared as a sockaddr.  As a result the\ncomparison practically never matches and locks are not released for the\nrequested IP.\n\nSwap the arguments so the lock owner's source address is compared\nagainst the requested server address:\n\n\treturn rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);\n\n[ cel: fix the misleading typedef parameter names too ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:29:19.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d72e78c9d38d5377a059a4837f82b65b91cdcf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/21bcb609e0ab1dd60f39ca3498f85808933bcc9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9060689f49dc663e9a3d069c4a65ff63a836e66"
        }
      ],
      "title": "lockd: fix swapped arguments in nlmsvc_match_ip()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93231",
    "datePublished": "2026-09-24T15:29:19.786Z",
    "dateReserved": "2026-09-17T16:02:15.095Z",
    "dateUpdated": "2026-09-24T15:29:19.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}