CVE-2026-22980: nfsd: provide locking for v4_end_grace
In the Linux kernel, the following vulnerability has been resolved:
nfsd: provide locking for v4_end_grace
Writing to v4_end_grace can race with server shutdown and result in
memory being accessed after it was freed - reclaim_str_hashtbl in
particularly.
We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is
held while client_tracking_op->init() is called and that can wait for
an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a
deadlock.
nfsd4_end_grace() is also called by the landromat work queue and this
doesn't require locking as server shutdown will stop the work and wait
for it before freeing anything that nfsd4_end_grace() might access.
However, we must be sure that writing to v4_end_grace doesn't restart
the work item after shutdown has already waited for it. For this we
add a new flag protected with nn->client_lock. It is set only while it
is safe to make client tracking calls, and v4_end_grace only schedules
work while the flag is set with the spinlock held.
So this patch adds a nfsd_net field "client_tracking_active" which is
set as described. Another field "grace_end_forced", is set when
v4_end_grace is written. After this is set, and providing
client_tracking_active is set, the laundromat is scheduled.
This "grace_end_forced" field bypasses other checks for whether the
grace period has finished.
This resolves a race which can result in use-after-free.
Security readout for executives and security teams
Plain-English summary
A race in the Linux NFS server can access freed memory when its NFSv4 grace period is forcibly ended while the server is shutting down. A successful trigger could compromise confidentiality, integrity, and availability, but the supplied CVSS assessment requires local, low-privileged access.
Executive priority
Prioritize prompt updates for shared NFS servers, multi-user hosts, and affected appliances where local users could reach the vulnerable path. Internet-facing NFS alone does not establish remote exploitability. Use normal expedited patching unless local compromise indicators or vendor guidance justify emergency handling.
Technical view
Writing v4_end_grace can race with nfsd shutdown, causing use-after-free, particularly involving reclaim_str_hashtbl. The fix coordinates client tracking and work scheduling under client_lock using client_tracking_active and grace_end_forced, without holding nfsd_mutex across nfsd4_end_grace(), which could deadlock through nfsdcltrack.
Likely exposure
Exposure is most relevant to systems running affected Linux kernels with the kernel NFS server in use. The supplied version data identifies affected releases from 3.18 through 6.19, but its formatting is ambiguous; validate exact exposure against the distribution or appliance vendor’s fixed-kernel guidance.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of active exploitation, public exploit availability, or demonstrated real-world impact.
Researcher notes
The source describes a shutdown race and use-after-free but supplies no reproducer, exploit evidence, or CWE. The design avoids an nfsd_mutex deadlock involving an nfsdcltrack upcall, instead gating client-tracking calls and laundromat scheduling with state protected by nn->client_lock. Practical exploitability and exact vulnerable release ranges require branch-specific validation.
Mitigation direction
Install the vendor-supported kernel update containing the appropriate stable fix.
Review the listed kernel stable commits to identify the fix for your maintained branch.
Consult the Siemens advisory for affected Siemens products and prescribed updates.
Limit local access to exposed NFS servers until updates are completed.
Avoid forcing NFSv4 grace termination during nfsd shutdown as temporary risk reduction.
Validation and detection
Inventory kernel versions on systems providing NFS services.
Confirm whether the kernel NFS server is enabled or running.
Map each kernel build to distribution or appliance vendor advisories.
Verify the updated kernel contains the branch-appropriate stable commit.
Check operational tooling for v4_end_grace writes during NFS shutdown.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-22980 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
2ADP providers
9Source links
SSVC decision data
CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.