CVE-2026-93212

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd

service thread loop calls it to drain entries that the filecache

garbage collector and shrinker append via

nfsd_file_dispose_list_delayed(). During per-net teardown,

nn->nfsd_serv is cleared before the filecache laundrette is shut

down, so the service thread can still run a dispose pass that finds

more than eight entries on l->freeme and dereferences a NULL

svc_serv:

nfsd service thread loop

nfsd_file_net_dispose(nn)

if (!list_empty(&l->freeme)) {

...

svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */

}

The sibling helper nfsd_file_dispose_list_delayed() already documents

this ordering and caches nn->nfsd_serv into a local before testing it

for NULL. nfsd_file_net_dispose() was introduced with the same raw

svc_wake_up(nn->nfsd_serv) call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References