All vulnerabilities
CVE-2026-93229

Linux: nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

Linux LinuxOperating systems
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1aea0482b98ecd7d0249204665f2ad4ad517f66bAlso 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8CVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1aea0482b98ecd7d0249204665f2ad4ad517f66bLinuxCVE List
  • 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() is missing a read memory barrier (smp_rmb) before its second counter check. The standard kernel read_seqcount_retry() includes smp_rmb() to ensure that all data reads complete before the counter is re-checked.

Without this barrier, on weakly-ordered architectures (ARM, POWER), the CPU may reorder field reads past the second counter check, making the retry logic ineffective: it could observe a consistent counter pair while reading fields that have been concurrently modified by the writer.

Add smp_rmb() before the second counter check to order the field reads ahead of it, matching the barrier semantics of the standard seqcount read-side. The begin-side smp_load_acquire() already pairs with the smp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering the field reads, the retry check no longer needs acquire semantics and reads the counter with a plain READ_ONCE(), as read_seqcount_retry() does.

[ cel: Use READ_ONCE instead of smp_load_acquire() ]

Text from CVE List

Affected versions 10

  • Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before f501f2f4ec1d2dfe39e21c98630314074a9b30b0CVE List
  • Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before 1aea0482b98ecd7d0249204665f2ad4ad517f66bCVE List
  • Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8CVE List
  • Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before a71f161a857117e8e0264deb7d14fff5c98adcf5CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.12.109 through 6.12.*CVE List
  • Linuxunaffected: 6.18.50 through 6.18.*CVE List
  • Linuxunaffected: 7.2.4 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4