CVE-2026-93221 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: convert nfsd_net boolean flags to unsigned long flags word
nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool:
if (nn->grace_ended) return; nn->grace_ended = true;
The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held:
laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace()
RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace()
Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory.
A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above.
Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified in the NFS server daemon subsystem involves a critical race condition within the nfsd_net structure, specifically concerning boolean flags used to track state during grace period management and client tracking operations. The core issue stems from multiple concurrent execution contexts accessing these boolean fields without proper serialization mechanisms such as mutexes or spinlocks. In multi-processor environments, this lack of atomicity allows for classic read-modify-write race conditions where two threads can simultaneously observe a flag as false, both proceed to set it to true, and subsequently execute critical cleanup code that assumes exclusive access. This scenario is particularly dangerous because the subsequent operations involve traversing complex data structures like hash tables containing client reclaim records, leading to memory corruption when multiple walkers attempt to modify or free entries concurrently.
The specific technical flaw centers on the grace_ended boolean field within nfsd_net. Two distinct execution paths can trigger this code path without holding any locks: the laundromat path executed by the laundry_wq kworker via nfs4_laundromat, and the reclaim complete path triggered by NFSv4 clients sending RECLAIM_COMPLETE requests via nfsd4_reclaim_complete. When both contexts execute concurrently on different CPUs, they may both read grace_ended as false before either has written true to it. Consequently, both threads proceed to call nfsd4_record_grace_done(), which invokes the active client tracking operations' grace_done callback. This callback is responsible for draining reclaim_str_hashtbl by iterating through its buckets and removing records using list_del followed by kfree. Since this iteration occurs without locking, two concurrent walkers will corrupt the linked lists within the hash table buckets, resulting in double-free vulnerabilities where a single nfs4_client_reclaim structure is freed twice.
The operational impact of this vulnerability extends beyond simple memory corruption to include potential denial of service and arbitrary code execution risks depending on heap layout exploitation possibilities. When list structures are corrupted due to concurrent modifications, subsequent iterations may traverse invalid pointers or access already-freed memory regions. Specifically, a call to nfs4_find_reclaim_client() iterating the same bucket while another thread is freeing entries can read through freed memory, leading to undefined behavior, kernel panics, or potentially exploitable conditions where an attacker controlling NFS client state could influence kernel execution flow. The vulnerability affects systems running NFSv4 servers with active clients performing reclaims during grace period transitions, a common scenario in enterprise storage environments relying on high availability and failover mechanisms that utilize reclaim operations to restore file locks after server restarts or network partitions.
Mitigation strategies involve both immediate patching of the kernel source code and architectural improvements to atomicity handling across all nfsd_net flags. The primary fix replaces scattered boolean fields with a single unsigned long flags word utilizing an enum for bit position definitions, ensuring consistent access patterns throughout the subsystem. For the critical grace_ended flag, the solution employs test_and_set_bit(), which provides hardware-level atomic read-modify-write semantics on all supported architectures, thereby eliminating the race condition entirely. Other related flags including grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, and lockd_up are converted to use test_bit, set_bit, and clear_bit operations for consistency. This approach not only fixes the immediate race but also avoids potential sub-word compare-and-exchange issues on architectures like Hexagon that only support word-sized atomic operations, ensuring robustness across diverse hardware platforms.
From a classification perspective, this vulnerability aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as multiple threads access shared data without adequate locking mechanisms to prevent race conditions. It also relates to CWE-416: Use After Free, given the potential for accessing freed memory during concurrent list traversal and deletion operations within nfsd4_recdir_purge_old and cld grace done callbacks. In terms of MITRE ATT&CK mapping, this falls under Tactic TA0005: Defense Evasion or potentially TA0003 Persistence if exploited to maintain access, but more accurately represents a technical weakness that could be leveraged in techniques such as T1499 Endpoint Denial of Service through kernel panic induction. Security practitioners should prioritize applying the patch that introduces atomic bit manipulation for nfsd_net flags and verify that all concurrent paths accessing these state variables are properly serialized or utilize appropriate atomic primitives to prevent similar race conditions in related subsystems.