CVE-2026-93221

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: convert nfsd_net boolean flags to unsigned long flags word

nfsd_net contains several boolean fields that are accessed from

concurrent contexts without serialization. In particular,

nfsd4_end_grace() guards its drain path with a plain bool:

if (nn->grace_ended)

return;

nn->grace_ended = true;

The read and the write are independent, and nothing in struct

nfsd_net serializes them. At least two contexts can reach this

code with no lock held:

laundromat path

laundry_wq kworker

nfs4_laundromat()

nfsd4_end_grace()

RECLAIM_COMPLETE path

nfsd compound kthread

nfsd4_reclaim_complete()

inc_reclaim_complete()

nfsd4_end_grace()

Both callers can observe grace_ended == false on different CPUs,

both store true, and both proceed into nfsd4_record_grace_done(),

which invokes the active client_tracking_ops->grace_done callback.

For trac

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References