CVE-2026-93211nfsd: initialize DRC hash table before registering shrinker
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinker_register() precedes the INIT_LIST_HEAD loop and the drc_hashsize store. On weakly-ordered architectures (arm64, ppc), a shrinker scan can observe drc_hashsize before the bucket list heads are initialized, causing a NULL deref in the DRC shrinker callback. Move bucket initialization and the drc_hashsize store before shrinker_register() so the hash table is fully initialized before it becomes visible to the shrinker.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 before f060f43a67635dbb393bf5dcbfc3e8b9a44942cb; from 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 before b57bd8cb739cb3cf88bdb1a5903a42a707a5c282; from 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 before 431c70ca5163c98c746f22f16cd58ca5aefec6dc; from 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 before b0c58934f5cc4f05b63ef6605dd10c1d0d489e88 | CNA record |
References
- https://git.kernel.org/stable/c/f060f43a67635dbb393bf5dcbfc3e8b9a44942cb
- https://git.kernel.org/stable/c/b57bd8cb739cb3cf88bdb1a5903a42a707a5c282
- https://git.kernel.org/stable/c/431c70ca5163c98c746f22f16cd58ca5aefec6dc
- https://git.kernel.org/stable/c/b0c58934f5cc4f05b63ef6605dd10c1d0d489e88
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.