CVE-2026-93212 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsd_file_dispose_list_delayed(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svc_serv:
nfsd service thread loop nfsd_file_net_dispose(nn) if (!list_empty(&l->freeme)) {
... svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */ }
The sibling helper nfsd_file_dispose_list_delayed() already documents this ordering and caches nn->nfsd_serv into a local before testing it for NULL. nfsd_file_net_dispose() was introduced with the same raw svc_wake_up(nn->nfsd_serv) call and never picked up the guard.
Fix by loading nn->nfsd_serv into a local svc_serv pointer and only calling svc_wake_up() when it is non-NULL, matching the pattern in nfsd_file_dispose_list_delayed().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the Linux kernel's NFS server implementation involves a use-after-free condition triggered during network namespace teardown. Specifically, the flaw resides in the function nfsd_file_net_dispose(), which serves as the consumer side for processing deferred file cache disposal entries. This routine is invoked by the nfsd service thread loop to drain items appended via nfsd_file_dispose_list_delayed(). The core issue arises from an incorrect ordering of operations during per-network namespace cleanup, where nn->nfsd_serv is cleared before the filecache laundrette is fully shut down. Consequently, if a dispose pass finds more than eight entries on the l->freeme list after the service pointer has been nullified, the code attempts to dereference this NULL svc_serv structure by calling svc_wake_up(nn->nfsd_serv). This results in a kernel panic or potential arbitrary code execution depending on memory layout and exploitation context.
From a technical perspective, this defect represents a classic race condition exacerbated by improper synchronization during resource deallocation. The sibling helper function nfsd_file_dispose_list_delayed() correctly handles this scenario by caching nn->nfsd_serv into a local variable before testing it for NULL, thereby ensuring that the service pointer remains valid throughout its usage within that context. However, nfsd_file_net_dispose(), introduced with similar functionality, failed to adopt this protective pattern and directly accessed the potentially nullified global structure member. This inconsistency highlights a gap in defensive programming practices where one function adheres to safe access patterns while another does not, leading to unpredictable behavior when network namespaces are destroyed concurrently with active file cache operations.
The operational impact of this vulnerability is significant for systems running NFS servers that utilize dynamic network namespace management or containerized environments where namespaces are frequently created and destroyed. An attacker who can trigger rapid creation and destruction of network namespaces while inducing high volumes of file cache activity could exploit the race condition to crash the system, leading to a denial-of-service scenario. In more sophisticated attack vectors involving specific memory layouts, dereferencing a NULL pointer with subsequent operations might allow for control flow hijacking or information disclosure, although the primary immediate effect is typically system instability due to kernel oopses.
To mitigate this vulnerability, it is essential to apply the upstream Linux kernel patch that modifies nfsd_file_net_dispose() to mirror the safe access pattern used in its sibling function. This involves loading nn->nfsd_serv into a local svc_serv pointer and only invoking svc_wake_up when this local variable is confirmed to be non-NULL. System administrators should ensure their kernels are updated to versions that include this fix, particularly if they operate NFS services with dynamic namespace configurations. Additionally, developers integrating similar patterns in custom kernel modules or out-of-tree drivers should audit their code for analogous race conditions during resource teardown phases to prevent similar dereference errors.
This vulnerability aligns with CWE-416, Use After Free, as it involves accessing a memory location that has been deallocated or invalidated due to improper sequencing of operations. Furthermore, the exploitation technique relates to ATT&CK Tactic TA0005, Defense Evasion, specifically through techniques that involve manipulating system resources to cause instability or bypass security controls by inducing crashes in critical subsystems like the NFS server infrastructure. Ensuring strict adherence to resource lifecycle management protocols and implementing consistent null-checking patterns across related functions is crucial for maintaining kernel integrity against such concurrency-related flaws.