211 lines
13 KiB
JSON
211 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-93221",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-17T16:02:15.094Z",
|
|
"datePublished": "2026-09-24T15:10:44.598Z",
|
|
"dateUpdated": "2026-10-21T12:52:22.888Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-21T12:52:22.888Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization. In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n if (nn->grace_ended)\n return;\n nn->grace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them. At least two contexts can reach this\ncode with no lock held:\n\n laundromat path\n laundry_wq kworker\n nfs4_laundromat()\n nfsd4_end_grace()\n\n RECLAIM_COMPLETE path\n nfsd compound kthread\n nfsd4_reclaim_complete()\n inc_reclaim_complete()\n nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops->grace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry. Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat's first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions. The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures. The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency. This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - nfsd4_end_grace() is reached from a remote NFSv4.1 RECLAIM_COMPLETE: svc_recv to nfsd_dispatch to nfsd4_proc_compound to nfsd4_sequence (sets cstate->clp) to nfsd4_reclaim_complete to inc_reclaim_complete to nfsd4_end_grace on TCP/2049. That RECLAIM_COMPLETE compound is the attacker-supplied protocol message.\nAC:H - The other nfsd4_end_grace() caller is nfs4_laundromat() on laundry_wq, queued in nfs4_state_start_net() for nn->nfsd4_grace seconds. A peer cannot start that work (nfsd4_force_end_grace is only write_v4_end_grace). Both must see grace_ended==false, which needs an already-running grace with a non-empty reclaim_str_hashtbl the attacker cannot create on demand.\nPR:N - Typical nfsd exports accept AUTH_SYS, so the client only asserts a uid. nfsd4_exchange_id() with SP4_NONE and nfsd4_create_session() are ALLOWED_AS_FIRST_OP without a filehandle, and OP_RECLAIM_COMPLETE is ALLOWED_WITHOUT_FH, so no fh_verify, share access, or Kerberos is required.\nUI:N - The attacker sends EXCHANGE_ID, CREATE_SESSION, SEQUENCE, and RECLAIM_COMPLETE on their own session. No write to v4_end_grace, mount, or other victim action is required.\nS:U - Concurrent nfs4_release_reclaim() list_del/kfree of nfs4_client_reclaim entries corrupts heap inside the host nfsd kernel. That stays in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - When two nfsd4_end_grace() callers both run nfsd4_record_grace_done() (nfsd4_cld_grace_done or nfsd4_recdir_purge_old), nfs4_release_reclaim() double-frees every nfs4_client_reclaim while nfsd4_find_reclaim_client() walks the same unlocked cr_strhash bucket through freed objects, a UAF read primitive.\nI:H - nfs4_remove_reclaim_record() does unlocked list_del(&crp->cr_strhash) then kfree on each nfs4_client_reclaim. Two concurrent walkers corrupt adjacent list pointers (unlink write) and double-free the slab objects, which is an arbitrary kernel write.\nA:H - The same unlocked list_del/kfree in nfs4_release_reclaim(), or nfsd4_find_reclaim_client() following a freed cr_strhash, oopses the host kernel (poisoned list pointers or double-free of nfs4_client_reclaim), a full availability loss."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfsd/netns.h",
|
|
"fs/nfsd/nfs4proc.c",
|
|
"fs/nfsd/nfs4recover.c",
|
|
"fs/nfsd/nfs4state.c",
|
|
"fs/nfsd/nfsctl.c",
|
|
"fs/nfsd/nfssvc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "362063a595be959bc08f4163e6405a0266740091",
|
|
"lessThan": "94b450977c60261903c945419d2df4a464de60c4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "362063a595be959bc08f4163e6405a0266740091",
|
|
"lessThan": "faac245ca739b66e96fb7bb43e21df537239a4e5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "362063a595be959bc08f4163e6405a0266740091",
|
|
"lessThan": "40bab0da844c142431a6b1cc21b4cf53491dac44",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "362063a595be959bc08f4163e6405a0266740091",
|
|
"lessThan": "df5922fe09a8131c793ffa86adf204999b0470f8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "362063a595be959bc08f4163e6405a0266740091",
|
|
"lessThan": "11a5fe42e1811f793e04ef885b639ea7668f439d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfsd/netns.h",
|
|
"fs/nfsd/nfs4proc.c",
|
|
"fs/nfsd/nfs4recover.c",
|
|
"fs/nfsd/nfs4state.c",
|
|
"fs/nfsd/nfsctl.c",
|
|
"fs/nfsd/nfssvc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.114",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.57",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.12.114"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.18.57"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"
|
|
}
|
|
],
|
|
"title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |