CVE-2026-93229 (GCVE-0-2026-93229)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:29 – Updated: 2026-09-25 05:09
VLAI
Title
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() is missing a read memory barrier (smp_rmb) before its second counter check. The standard kernel read_seqcount_retry() includes smp_rmb() to ensure that all data reads complete before the counter is re-checked. Without this barrier, on weakly-ordered architectures (ARM, POWER), the CPU may reorder field reads past the second counter check, making the retry logic ineffective: it could observe a consistent counter pair while reading fields that have been concurrently modified by the writer. Add smp_rmb() before the second counter check to order the field reads ahead of it, matching the barrier semantics of the standard seqcount read-side. The begin-side smp_load_acquire() already pairs with the smp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering the field reads, the retry check no longer needs acquire semantics and reads the counter with a plain READ_ONCE(), as read_seqcount_retry() does. [ cel: Use READ_ONCE instead of smp_load_acquire() ]
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < f501f2f4ec1d2dfe39e21c98630314074a9b30b0 (git)
Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < 1aea0482b98ecd7d0249204665f2ad4ad517f66b (git)
Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8 (git)
Affected: bd9d6a3efa9709e653aafbeb859289feccb8e70c , < a71f161a857117e8e0264deb7d14fff5c98adcf5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f501f2f4ec1d2dfe39e21c98630314074a9b30b0",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "1aea0482b98ecd7d0249204665f2ad4ad517f66b",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "a71f161a857117e8e0264deb7d14fff5c98adcf5",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add missing read barrier to rpc_status_get dumpit seqcount retry\n\nThe hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()\nis missing a read memory barrier (smp_rmb) before its second counter\ncheck.  The standard kernel read_seqcount_retry() includes smp_rmb()\nto ensure that all data reads complete before the counter is re-checked.\n\nWithout this barrier, on weakly-ordered architectures (ARM, POWER),\nthe CPU may reorder field reads past the second counter check, making\nthe retry logic ineffective: it could observe a consistent counter pair\nwhile reading fields that have been concurrently modified by the writer.\n\nAdd smp_rmb() before the second counter check to order the field reads\nahead of it, matching the barrier semantics of the standard seqcount\nread-side.  The begin-side smp_load_acquire() already pairs with the\nsmp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering\nthe field reads, the retry check no longer needs acquire semantics and\nreads the counter with a plain READ_ONCE(), as read_seqcount_retry()\ndoes.\n\n[ cel: Use READ_ONCE instead of smp_load_acquire() ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The missing smp_rmb is in nfsd_nl_rpc_status_get_dumpit(), reached only via NFSD_CMD_RPC_STATUS_GET over AF_NETLINK (nfsd_nl_ops dumpit). Remote NFS RPCs in nfsd_dispatch() only write rq_status_counter and never enter dumpit, so exploitation requires local netlink.\nAC:L - The attacker loops NFSD_CMD_RPC_STATUS_GET while sending NFSv4 COMPOUNDs with more than eight ops so nfsd_dispatch() smp_store_release()s rq_status_counter and nfsd4_release_compoundargs() mutates args-\u003eops/opcnt. Both sides of the seqcount race are attacker-driven; weakly-ordered ARM/POWER where the missing smp_rmb matters is mainstream.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered in nfsd_nl_ops with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so genl_family_rcv_msg() skips the CAP_NET_ADMIN check. Any unprivileged process in the nfsd network namespace can invoke the dump.\nUI:N - The attacker issues the NFSD_CMD_RPC_STATUS_GET dump and the concurrent NFSv4 COMPOUNDs themselves. No separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The torn and out-of-bounds reads occur in host-kernel nfsd_nl_rpc_status_get_dumpit() on the local machine. Impact stays inside one security authority and is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - Without smp_rmb(), dumpit can pass the rq_status_counter retry and still load args-\u003eopcnt before nfsd4_release_compoundargs() zeros it and args-\u003eops after it is switched to iops[8]. Indices 8-15 then read adjacent slab at nfsd4_op stride and return those u32s via NFSD_A_RPC_STATUS_COMPOUND_OPS.\nI:N - nfsd_nl_rpc_status_get_dumpit() only copies opnum, xid, addresses and related fields into a stack nfsd_genl_rqstp for netlink. The missing retry barrier yields an out-of-bounds or torn read, not an out-of-bounds write, use-after-free write, or control-flow hijack.\nA:H - Slots 8-15 are sampled at sizeof(struct nfsd4_op) stride past the trailing iops[8] array in kmalloc\u0027d nfsd4_compoundargs into adjacent or unmapped slab pages, which can oops nfsd_nl_rpc_status_get_dumpit() even if the leak is not turned into a stable read."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:49.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f501f2f4ec1d2dfe39e21c98630314074a9b30b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aea0482b98ecd7d0249204665f2ad4ad517f66b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a71f161a857117e8e0264deb7d14fff5c98adcf5"
        }
      ],
      "title": "nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93229",
    "datePublished": "2026-09-24T15:29:14.322Z",
    "dateReserved": "2026-09-17T16:02:15.094Z",
    "dateUpdated": "2026-09-25T05:09:49.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93229",
      "date": "2026-09-28",
      "epss": "0.00125",
      "percentile": "0.01897"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfsctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f501f2f4ec1d2dfe39e21c98630314074a9b30b0",
                    "status": "affected",
                    "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1aea0482b98ecd7d0249204665f2ad4ad517f66b",
                    "status": "affected",
                    "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8",
                    "status": "affected",
                    "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a71f161a857117e8e0264deb7d14fff5c98adcf5",
                    "status": "affected",
                    "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfsctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add missing read barrier to rpc_status_get dumpit seqcount retry\n\nThe hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()\nis missing a read memory barrier (smp_rmb) before its second counter\ncheck.  The standard kernel read_seqcount_retry() includes smp_rmb()\nto ensure that all data reads complete before the counter is re-checked.\n\nWithout this barrier, on weakly-ordered architectures (ARM, POWER),\nthe CPU may reorder field reads past the second counter check, making\nthe retry logic ineffective: it could observe a consistent counter pair\nwhile reading fields that have been concurrently modified by the writer.\n\nAdd smp_rmb() before the second counter check to order the field reads\nahead of it, matching the barrier semantics of the standard seqcount\nread-side.  The begin-side smp_load_acquire() already pairs with the\nsmp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering\nthe field reads, the retry check no longer needs acquire semantics and\nreads the counter with a plain READ_ONCE(), as read_seqcount_retry()\ndoes.\n\n[ cel: Use READ_ONCE instead of smp_load_acquire() ]"
          }
        ],
        "id": "CVE-2026-93229",
        "lastModified": "2026-09-25T05:17:00.707",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T16:17:18.387",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1aea0482b98ecd7d0249204665f2ad4ad517f66b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a71f161a857117e8e0264deb7d14fff5c98adcf5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f501f2f4ec1d2dfe39e21c98630314074a9b30b0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-25T23:50:21Z",
      "cve": "CVE-2026-93229",
      "id": "CVE-2026-93229",
      "initial_release_date": "2026-09-25T23:50:21Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93229",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93229.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.