CVE-2026-93221 (GCVE-0-2026-93221)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:10 – Updated: 2026-09-25 05:09
VLAI
Title
nfsd: convert nfsd_net boolean flags to unsigned long flags word
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool: if (nn->grace_ended) return; nn->grace_ended = true; The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held: laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace() RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace() Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory. A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above. Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 362063a595be959bc08f4163e6405a0266740091 , < df5922fe09a8131c793ffa86adf204999b0470f8 (git)
Affected: 362063a595be959bc08f4163e6405a0266740091 , < 11a5fe42e1811f793e04ef885b639ea7668f439d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4recover.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df5922fe09a8131c793ffa86adf204999b0470f8",
              "status": "affected",
              "version": "362063a595be959bc08f4163e6405a0266740091",
              "versionType": "git"
            },
            {
              "lessThan": "11a5fe42e1811f793e04ef885b639ea7668f439d",
              "status": "affected",
              "version": "362063a595be959bc08f4163e6405a0266740091",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4recover.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization.  In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n    if (nn-\u003egrace_ended)\n            return;\n    nn-\u003egrace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them.  At least two contexts can reach this\ncode with no lock held:\n\n    laundromat path\n      laundry_wq kworker\n        nfs4_laundromat()\n          nfsd4_end_grace()\n\n    RECLAIM_COMPLETE path\n      nfsd compound kthread\n        nfsd4_reclaim_complete()\n          inc_reclaim_complete()\n            nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops-\u003egrace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry.  Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim.  A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat\u0027s first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions.  The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures.  The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency.  This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd4_end_grace() is reached from a remote NFSv4.1 RECLAIM_COMPLETE: svc_recv to nfsd_dispatch to nfsd4_proc_compound to nfsd4_sequence (sets cstate-\u003eclp) to nfsd4_reclaim_complete to inc_reclaim_complete to nfsd4_end_grace on TCP/2049. That RECLAIM_COMPLETE compound is the attacker-supplied protocol message.\nAC:H - The other nfsd4_end_grace() caller is nfs4_laundromat() on laundry_wq, queued in nfs4_state_start_net() for nn-\u003enfsd4_grace seconds. A peer cannot start that work (nfsd4_force_end_grace is only write_v4_end_grace). Both must see grace_ended==false, which needs an already-running grace with a non-empty reclaim_str_hashtbl the attacker cannot create on demand.\nPR:N - Typical nfsd exports accept AUTH_SYS, so the client only asserts a uid. nfsd4_exchange_id() with SP4_NONE and nfsd4_create_session() are ALLOWED_AS_FIRST_OP without a filehandle, and OP_RECLAIM_COMPLETE is ALLOWED_WITHOUT_FH, so no fh_verify, share access, or Kerberos is required.\nUI:N - The attacker sends EXCHANGE_ID, CREATE_SESSION, SEQUENCE, and RECLAIM_COMPLETE on their own session. No write to v4_end_grace, mount, or other victim action is required.\nS:U - Concurrent nfs4_release_reclaim() list_del/kfree of nfs4_client_reclaim entries corrupts heap inside the host nfsd kernel. That stays in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - When two nfsd4_end_grace() callers both run nfsd4_record_grace_done() (nfsd4_cld_grace_done or nfsd4_recdir_purge_old), nfs4_release_reclaim() double-frees every nfs4_client_reclaim while nfsd4_find_reclaim_client() walks the same unlocked cr_strhash bucket through freed objects, a UAF read primitive.\nI:H - nfs4_remove_reclaim_record() does unlocked list_del(\u0026crp-\u003ecr_strhash) then kfree on each nfs4_client_reclaim. Two concurrent walkers corrupt adjacent list pointers (unlink write) and double-free the slab objects, which is an arbitrary kernel write.\nA:H - The same unlocked list_del/kfree in nfs4_release_reclaim(), or nfsd4_find_reclaim_client() following a freed cr_strhash, oopses the host kernel (poisoned list pointers or double-free of nfs4_client_reclaim), a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:44.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"
        }
      ],
      "title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93221",
    "datePublished": "2026-09-24T15:10:44.598Z",
    "dateReserved": "2026-09-17T16:02:15.094Z",
    "dateUpdated": "2026-09-25T05:09:44.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93221",
      "date": "2026-09-28",
      "epss": "0.0033",
      "percentile": "0.23591"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T01:45:53.000Z",
      "cve": "CVE-2026-93221",
      "id": "msrc_CVE-2026-93221",
      "initial_release_date": "2026-09-28T00:34:29.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93221.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/netns.h",
                  "fs/nfsd/nfs4proc.c",
                  "fs/nfsd/nfs4recover.c",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/nfsctl.c",
                  "fs/nfsd/nfssvc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "df5922fe09a8131c793ffa86adf204999b0470f8",
                    "status": "affected",
                    "version": "362063a595be959bc08f4163e6405a0266740091",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11a5fe42e1811f793e04ef885b639ea7668f439d",
                    "status": "affected",
                    "version": "362063a595be959bc08f4163e6405a0266740091",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/netns.h",
                  "fs/nfsd/nfs4proc.c",
                  "fs/nfsd/nfs4recover.c",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/nfsctl.c",
                  "fs/nfsd/nfssvc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization.  In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n    if (nn-\u003egrace_ended)\n            return;\n    nn-\u003egrace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them.  At least two contexts can reach this\ncode with no lock held:\n\n    laundromat path\n      laundry_wq kworker\n        nfs4_laundromat()\n          nfsd4_end_grace()\n\n    RECLAIM_COMPLETE path\n      nfsd compound kthread\n        nfsd4_reclaim_complete()\n          inc_reclaim_complete()\n            nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops-\u003egrace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry.  Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim.  A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat\u0027s first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions.  The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures.  The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency.  This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."
          }
        ],
        "id": "CVE-2026-93221",
        "lastModified": "2026-09-25T05:17:00.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T16:17:17.310",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-25T23:50:33Z",
      "cve": "CVE-2026-93221",
      "id": "CVE-2026-93221",
      "initial_release_date": "2026-09-25T23:50:33Z",
      "product_status:known_affected": "254",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93221",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93221.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.