Skip to main content

Linux Kernel CVE-2026-93221

| EUVDEUVD-2026-85950 HIGH
2026-09-24 Linux GHSA-r3mg-g23p-86c9
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain NFSv4 client access to nfsd export
  2. Delivery
    Issue RECLAIM_COMPLETE during grace period
  3. Exploit
    Race laundromat grace-end drain
  4. Execution
    Concurrent unlocked reclaim hashtable walk
  5. Persist
    Double-free/list corruption
  6. Impact
    Kernel crash (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the target host to be running the in-kernel NFS server (nfsd) with NFSv4 clients, and the vulnerable window is the NFSv4 grace period following server (re)start. Triggering the racing RECLAIM_COMPLETE path realistically requires being a permitted NFSv4 client of an export. Exploitation is limited by the need to win a tight, attacker-uncontrolled timing race between the laundromat kworker and a RECLAIM_COMPLETE compound reaching nfsd4_end_grace concurrently on separate CPUs; the third caller (nfs4_state_start_net skip_grace path) runs under nfsd_mutex before any client connects and cannot race. Hosts without nfsd enabled are unaffected.
Impact

The published CVSS 3.1 vector (8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. The root cause is a concurrency bug in the in-kernel NFS server (nfsd): the grace_ended boolean and other nfsd_net flags are read/written without serialization, so the laundromat kworker (nfs4_laundromat → nfsd4_end_grace) and an NFSv4 RECLAIM_COMPLETE compound (nfsd4_reclaim_complete → inc_reclaim_complete → nfsd4_end_grace) can both observe grace_ended==false, both enter nfsd4_record_grace_done, and both walk reclaim_str_hashtbl unlocked - corrupting the list and double-freeing every nfs4_client_reclaim, with a concurrent nfsd4_find_reclaim_client reading freed memory. This is fundamentally CWE-362 → double-free/UAF (memory corruption), which is crash/DoS-dominant; the C:H rating is generous (a narrow use-after-free read window exists but is not a controllable disclosure primitive). AC:H is correct - success depends on winning a tight timing window between two independent kernel contexts during the NFS grace period, which the attacker does not directly control. PR:N is also questionable: triggering the RECLAIM_COMPLETE path realistically requires being a permitted NFSv4 client of the export. There is NO EPSS score, NO CISA KEV listing, and NO public POC, so no signal of active or imminent exploitation. Net: a legitimate kernel hardening fix but far below the 8.1 headline - realistically a mid-severity, hard-to-time local/adjacent DoS rather than a network RCE-class priority.
Exploit ScenarioDerived

A permitted NFSv4 client repeatedly connects to an nfsd server and issues RECLAIM_COMPLETE operations timed against the periodic laundromat grace-period drain, hoping both paths reach nfsd4_end_grace simultaneously on different CPUs. If the race is won, reclaim_str_hashtbl is walked concurrently, causing list corruption and a double-free of nfs4_client_reclaim structures, typically panicking the server. No public exploit code exists and the timing window is narrow, so reliable weaponization is difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A race condition in the Linux kernel's in-kernel NFS server (nfsd) allows two concurrent callers of nfsd4_end_grace() to both see the non-atomic grace_ended boolean as unset during the NFSv4 grace period following server (re)start, causing both to run the grace-done drain of reclaim_str_hashtbl and corrupt the list with double-frees and use-after-free reads. The defect dates to Linux 5.2 and is resolved by vendor-released patches in Linux 7.2.4 and 7.3-rc1; no public exploit code has been identified at time of analysis, and there is no KEV entry or EPSS data indicating active exploitation. Exploitation realistically requires a permitted NFSv4 client of an export and winning a tight, attacker-uncontrolled timing race between the laundromat kworker and a RECLAIM_COMPLETE compound, so the published CVSS 8.1 vector overstates real-world risk; the assessed vector is AC:H/PR:L with limited confidentiality and integrity impact and high availability impact, and hosts that do not run nfsd are unaffected.

RemediationAI

Apply the vendor-released kernel fix: upgrade to Linux 7.2.4 or 7.3-rc1 (or a later release containing the upstream commits df5922fe09a8131c793ffa86adf204999b0470f8 and 11a5fe42e1811f793e04ef885b639ea7668f439d, available at https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8 and https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d), and confirm that each downstream distribution has backported the equivalent change. If immediate kernel updates are not feasible, the highest-value compensating control is to reduce exposure of the vulnerable RECLAIM_COMPLETE path by restricting which hosts may reach the NFS service: tighten export permissions and client allowlists, firewall the NFS ports (2049 and the rpcbind/mountd range) to trusted networks, and require RPCSEC_GSS authentication, understanding that this limits availability for legitimate clients and does not eliminate the race for permitted clients. Where NFSv4 features are not required, disabling or not loading the in-kernel nfsd server, or serving only NFSv3 from user-space servers, removes the affected code path at the cost of losing NFSv4 semantics such as stateful reclaim and delegations; disabling nfsd entirely is not acceptable on hosts that must export NFS. Note that no public exploit code is known, so prioritization can follow normal kernel patch cadence, but the high availability impact and memory-corruption outcome make prompt scheduling advisable.

Affected VersionsENISA

Linux patch: 7.3-rc1
Linux 362063a595be959bc08f4163e6405a0266740091 <df5922fe09a8131c793ffa86adf204999b0470f8
Linux 5.2
Linux patch: 0
Linux patch: 7.2.4
Linux 362063a595be959bc08f4163e6405a0266740091 <11a5fe42e1811f793e04ef885b639ea7668f439d

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the kernel NFS server's per-network-namespace state structure, nfsd_net, which historically stored several plain boolean fields (including grace_ended, grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) that are read and written from concurrent contexts without serialization. nfsd4_end_grace() tested the plain bool grace_ended and then set it to true as two independent operations, so the laundromat kworker path (nfs4_laundromat -> nfsd4_end_grace) and an NFSv4 compound kthread path (nfsd4_reclaim_complete -> inc_reclaim_complete -> nfsd4_end_grace) could both observe false on different CPUs and both proceed into nfsd4_record_grace_done(), invoking the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every hash bucket without a lock and calls nfs4_remove_reclaim_record() (list_del followed by kfree) on each entry; two concurrent walkers therefore corrupt the reclaim list and double-free nfs4_client_reclaim objects, while nfsd4_find_reclaim_client() iterating the same bucket can read freed memory. This maps to the race-condition class (CWE-362) with secondary double-free (CWE-415) and use-after-free (CWE-416) consequences. The upstream fix replaces the scattered booleans with a single unsigned long flags word and an enum nfsd_net_flag bit layout, making the grace_ended transition atomic through test_and_set_bit() and converting the remaining flags to test_bit/set_bit/clear_bit, which also avoids sub-word cmpxchg limitations on architectures such as Hexagon that only support word-sized atomics. A third caller in nfs4_state_start_net() on the skip_grace startup path is not racy because it executes under nfsd_mutex before any client connects and before the laundromat's first delayed work fires.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

NFS-reachable so AV:N but a tight uncontrolled timing race gives AC:H; needs permitted NFSv4 client so PR:L; double-free/UAF is crash-dominant (A:H) with only incidental C:L/I:L.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
8.1 (HIGH)
Patch available
Sep 24, 2026 - 16:02 EUVD
CVE Published
Sep 24, 2026 - 15:10 cve.org
HIGH 8.1
CVE Published
Sep 24, 2026 - 15:10 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfsd: convert nfsd_net boolean flags to unsigned long flags word

nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool:

if (nn->grace_ended) return; nn->grace_ended = true;

The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held:

laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace()

RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace()

Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory.

A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above.

Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.

Executive ViewAI

Why It Matters

A race condition in the Linux kernel's in-kernel NFS server (nfsd) can corrupt kernel memory and cause availability loss on servers that export NFSv4 file systems, potentially disrupting shared storage for dependent applications and users. Only organizations running vulnerable nfsd kernels with accessible NFSv4 exports are affected, and exploitation requires an authenticated NFSv4 client plus a difficult, attacker-uncontrolled timing condition; no public exploit identified at time of analysis and vendor patches are available.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
High
in-kernel NFS server, common on Linux file servers and NAS
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93221 ADVISORY https://vuldb.com/vuln/409409 REF https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d REF https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44 REF https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4 REF https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8 REF https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy