SB20260925151 - Race condition in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-93221)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a race condition in nfsd4_end_grace() when grace completion is concurrently processed by the laundromat workqueue and RECLAIM_COMPLETE handling. A remote attacker can issue RECLAIM_COMPLETE requests during grace-period processing to cause memory corruption.

The race can cause concurrent reclaim-record walkers to corrupt reclaim_str_hashtbl and double-free nfs4_client_reclaim entries.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d
• https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8