{"id":"CVE-2026-93212","summary":"nfsd: guard nfsd_serv deref in nfsd_file_net_dispose","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: guard nfsd_serv deref in nfsd_file_net_dispose\n\nnfsd_file_net_dispose() is the consumer side of l-\u003efreeme: the nfsd\nservice thread loop calls it to drain entries that the filecache\ngarbage collector and shrinker append via\nnfsd_file_dispose_list_delayed().  During per-net teardown,\nnn-\u003enfsd_serv is cleared before the filecache laundrette is shut\ndown, so the service thread can still run a dispose pass that finds\nmore than eight entries on l-\u003efreeme and dereferences a NULL\nsvc_serv:\n\n    nfsd service thread loop\n      nfsd_file_net_dispose(nn)\n        if (!list_empty(&l-\u003efreeme)) {\n            ...\n            svc_wake_up(nn-\u003enfsd_serv);   /* nn-\u003enfsd_serv == NULL */\n        }\n\nThe sibling helper nfsd_file_dispose_list_delayed() already documents\nthis ordering and caches nn-\u003enfsd_serv into a local before testing it\nfor NULL.  nfsd_file_net_dispose() was introduced with the same raw\nsvc_wake_up(nn-\u003enfsd_serv) call and never picked up the guard.\n\nFix by loading nn-\u003enfsd_serv into a local svc_serv pointer and only\ncalling svc_wake_up() when it is non-NULL, matching the pattern in\nnfsd_file_dispose_list_delayed().","modified":"2026-09-25T03:48:52.166615164Z","published":"2026-09-24T15:10:35.280Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93212.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/59baf45a06435194005fc5fa9a42d89f77a30432"},{"type":"WEB","url":"https://git.kernel.org/stable/c/766170b4fd2daaf5c4d6735560101474e18edab6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9f1ddfc8cb9076592401a611eb3a44d36186d014"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f4776c1c4b38fbc459420321c8ece87d0f7f95fb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93212.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93212"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ffb402596147ac583f3464ff5c48feb9423e3838"},{"fixed":"f4776c1c4b38fbc459420321c8ece87d0f7f95fb"},{"fixed":"59baf45a06435194005fc5fa9a42d89f77a30432"},{"fixed":"766170b4fd2daaf5c4d6735560101474e18edab6"},{"fixed":"9f1ddfc8cb9076592401a611eb3a44d36186d014"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93212.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93212.json"}}],"schema_version":"1.9.0"}