CVE-2026-22980

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: provide locking for v4_end_grace

Writing to v4_end_grace can race with server shutdown and result in

memory being accessed after it was freed - reclaim_str_hashtbl in

particularly.

We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is

held while client_tracking_op->init() is called and that can wait for

an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a

deadlock.

nfsd4_end_grace() is also called by the landromat work queue and this

doesn't require locking as server shutdown will stop the work and wait

for it before freeing anything that nfsd4_end_grace() might access.

However, we must be sure that writing to v4_end_grace doesn't restart

the work item after shutdown has already waited for it. For this we

add a new flag protected with nn->client_lock. It is set only while it

is safe to make client tracking calls, and v4_end_grace only schedules

work while the flag is se

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References