{
  "cveId": "CVE-2026-93221",
  "url": "https://patchblox.com/security/cve/CVE-2026-93221",
  "summary": "CVE-2026-93221 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-93221, released September 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nfsd: convert nfsd_net boolean flags to unsigned long flags word  nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization.  In particular, nfsd4_end_grace() guards its drain path with a plain bool:      if (nn-\u003Egrace_ended)             return;     nn-\u003Egrace_ended = true;  The read and the write are independent, and nothing in struct nfsd_net serializes them.  At least two contexts can reach this code with no lock held:      laundromat path       laundry_wq kworker         nfs4_laundromat()           nfsd4_end_grace()      RECLAIM_COMPLETE path       nfsd compound kthread         nfsd4_reclaim_complete()           inc_reclaim_complete()             nfsd4_end_grace()  Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops-\u003Egrace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1\u002B ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del \u002B kfree) on each entry.  Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim.  A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory.  A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat\u0027s first delayed work fires, so it cannot race with the two callers above.  Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions.  The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures.  The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency.  This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.",
  "published": "2026-09-24T16:17:17Z",
  "severity": "Important",
  "cvss": 8.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00417,
  "epssPercentile": 0.36244,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93221",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-93221",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93221",
      "released": "2026-09-24T19:30:44Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93221",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93221",
      "released": "2026-09-24T19:30:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}