LiveActive security incident?Get immediate response
CVE Record

CVE-2026-22980: nfsd: provide locking for v4_end_grace

In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in the Linux NFS server can access freed memory when its NFSv4 grace period is forcibly ended while the server is shutting down. A successful trigger could compromise confidentiality, integrity, and availability, but the supplied CVSS assessment requires local, low-privileged access.

Executive priority

Prioritize prompt updates for shared NFS servers, multi-user hosts, and affected appliances where local users could reach the vulnerable path. Internet-facing NFS alone does not establish remote exploitability. Use normal expedited patching unless local compromise indicators or vendor guidance justify emergency handling.

Technical view

Writing v4_end_grace can race with nfsd shutdown, causing use-after-free, particularly involving reclaim_str_hashtbl. The fix coordinates client tracking and work scheduling under client_lock using client_tracking_active and grace_end_forced, without holding nfsd_mutex across nfsd4_end_grace(), which could deadlock through nfsdcltrack.

Likely exposure

Exposure is most relevant to systems running affected Linux kernels with the kernel NFS server in use. The supplied version data identifies affected releases from 3.18 through 6.19, but its formatting is ambiguous; validate exact exposure against the distribution or appliance vendor’s fixed-kernel guidance.

Exploitation context

The CVSS vector is local, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of active exploitation, public exploit availability, or demonstrated real-world impact.

Researcher notes

The source describes a shutdown race and use-after-free but supplies no reproducer, exploit evidence, or CWE. The design avoids an nfsd_mutex deadlock involving an nfsdcltrack upcall, instead gating client-tracking calls and laundromat scheduling with state protected by nn->client_lock. Practical exploitability and exact vulnerable release ranges require branch-specific validation.

Mitigation direction

  • Install the vendor-supported kernel update containing the appropriate stable fix.
  • Review the listed kernel stable commits to identify the fix for your maintained branch.
  • Consult the Siemens advisory for affected Siemens products and prescribed updates.
  • Limit local access to exposed NFS servers until updates are completed.
  • Avoid forcing NFSv4 grace termination during nfsd shutdown as temporary risk reduction.

Validation and detection

  • Inventory kernel versions on systems providing NFS services.
  • Confirm whether the kernel NFS server is enabled or running.
  • Map each kernel build to distribution or appliance vendor advisories.
  • Verify the updated kernel contains the branch-appropriate stable commit.
  • Check operational tooling for v4_end_grace writes during NFS shutdown.
Prepared
Confidence
high
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-22980 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-22980Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6, 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6unaffected
LinuxLinux3.18, 0, 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.