nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsd_file_dispose_list_delayed(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svc_serv: nfsd service thread loop nfsd_file_net_dispose(nn) if (!list_empty(&l->freeme)) { ... svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */ } The sibling helper nfsd_file_dispose_list_delayed() already documents this ordering and caches nn->nfsd_serv into a local before testing it for NULL. nfsd_file_net_dispose() was introduced with the same raw svc_wake_up(nn->nfsd_serv) call and never picked up the guard. Fix by loading nn->nfsd_serv into a local svc_serv pointer and only calling svc_wake_up() when it is non-NULL, matching the pattern in nfsd_file_dispose_list_delayed().
CVE-2026-93212
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93212
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ffb402596147ac583f3464ff5c48feb9423e3838",
"lessThan": "f4776c1c4b38fbc459420321c8ece87d0f7f95fb",
"versionType": "git"
},
{
"status": "affected",
"version": "ffb402596147ac583f3464ff5c48feb9423e3838",
"lessThan": "59baf45a06435194005fc5fa9a42d89f77a30432",
"versionType": "git"
},
{
"status": "affected",
"version": "ffb402596147ac583f3464ff5c48feb9423e3838",
"lessThan": "766170b4fd2daaf5c4d6735560101474e18edab6",
"versionType": "git"
},
{
"status": "affected",
"version": "ffb402596147ac583f3464ff5c48feb9423e3838",
"lessThan": "9f1ddfc8cb9076592401a611eb3a44d36186d014",
"versionType": "git"
}
],
"programFiles": [
"fs/nfsd/filecache.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/nfsd/filecache.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-93212
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #37915 · Revision 1
- Added to Heist Feed
- Publisher date