Description
In the Linux kernel, the following vulnerability has been resolved:

nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd
service thread loop calls it to drain entries that the filecache
garbage collector and shrinker append via
nfsd_file_dispose_list_delayed(). During per-net teardown,
nn->nfsd_serv is cleared before the filecache laundrette is shut
down, so the service thread can still run a dispose pass that finds
more than eight entries on l->freeme and dereferences a NULL
svc_serv:

nfsd service thread loop
nfsd_file_net_dispose(nn)
if (!list_empty(&l->freeme)) {
...
svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */
}

The sibling helper nfsd_file_dispose_list_delayed() already documents
this ordering and caches nn->nfsd_serv into a local before testing it
for NULL. nfsd_file_net_dispose() was introduced with the same raw
svc_wake_up(nn->nfsd_serv) call and never picked up the guard.

Fix by loading nn->nfsd_serv into a local svc_serv pointer and only
calling svc_wake_up() when it is non-NULL, matching the pattern in
nfsd_file_dispose_list_delayed().
Published: 2026-09-24
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: NFS server null pointer dereference potentially causing denial of service
Action: Apply patch
AI Analysis

Impact

In the Linux kernel NFS server, the cleanup routine nfsd_file_net_dispose calls svc_wake_up with a potentially NULL service pointer. This occurs during the teardown of a network namespace after the service thread is still active, allowing a thread to dereference a NULL svc_serv and crash the kernel. The failure to guard against the NULL pointer can lead to a denial of service by crashing the NFS daemon or the entire kernel if the crash propagates. This weakness is a classic null pointer dereference and follows the pattern of a race condition on shared data structures.

Affected Systems

All users of the Linux Linux kernel that run the NFS server service are affected. The specific code path operates in the nfsd subsystem of the kernel; versions prior to the patches referenced in the provided commit URLs contain the vulnerability. No vendor‑specific release information is provided beyond the canonical Linux kernel.

Risk and Exploitability

The exploitation requires a remote or local actor to trigger the NFS service thread to run during network namespace teardown, which is a low‑probability scenario in normal operation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not disclosed, but the impact is a denial of service that may crash the kernel, making it a high‑severity concern for systems running NFS services that cannot tolerate downtime.

Generated by OpenCVE AI on September 25, 2026 at 11:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the patch from the linked commits, which guard the svc_wake_up call in nfsd_file_net_dispose
  • Restart the system after the kernel upgrade to ensure the new code is loaded
  • If uptime is critical, temporarily disable NFS services during the kernel upgrade or validate the issue does not manifest under your workload before full deployment

Generated by OpenCVE AI on September 25, 2026 at 11:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DSA Debian DSA DSA-6528-1 linux security update
History

Fri, 25 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsd_file_dispose_list_delayed(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svc_serv: nfsd service thread loop nfsd_file_net_dispose(nn) if (!list_empty(&l->freeme)) { ... svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */ } The sibling helper nfsd_file_dispose_list_delayed() already documents this ordering and caches nn->nfsd_serv into a local before testing it for NULL. nfsd_file_net_dispose() was introduced with the same raw svc_wake_up(nn->nfsd_serv) call and never picked up the guard. Fix by loading nn->nfsd_serv into a local svc_serv pointer and only calling svc_wake_up() when it is non-NULL, matching the pattern in nfsd_file_dispose_list_delayed().
Title nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T15:10:35.280Z

Reserved: 2026-09-17T16:02:15.093Z

Link: CVE-2026-93212

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T16:17:16.133

Modified: 2026-09-24T16:17:16.133

Link: CVE-2026-93212

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T11:30:16Z

Weaknesses