CVE-2026-93221

A flaw was found in the Linux kernel's NFS daemon (nfsd). A race condition occurs when multiple internal processes concurrently access the grace_ended flag without proper synchronization. This can lead to memory corruption, including double-free vulnerabilities and attempts to read from freed memory. The most significant consequence is a potential denial of service, which could impact system availability.

A race in nfsd grace period completion allows the laundromat worker and an NFSv4 RECLAIM_COMPLETE request handler to concurrently enter nfsd4_end_grace. Both paths can invoke grace completion callbacks that walk reclaim_str_hashtbl and free the same nfs4_client_reclaim entries, resulting in list corruption, double-free, and use-after-free conditions. A network reachable NFSv4 client may trigger the race during the server grace period. For the CVSS the PR:L value is used because reliable triggering requires an authorized or established NFS client context able to perform relevant reclaim operations. The race timing makes AC:H appropriate. Impact is at least a remote denial of service through kernel memory corruption. In the paranoid case the double-free and use-after-free may allow confidentiality and integrity impact and should be reviewed manually. NFS servers are often deployed on internal storage networks, but systems exposing NFSv4 to untrusted client networks have higher practical risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.