CVE-2026-22980 nfsd: provide locking for v4_end_grace
A race condition in the Linux kernel NFS server allows a use-after-free vulnerability, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22980?
CVE-2026-22980 is a high-severity use after free vulnerability in Linux kernel, published on 23 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: provide locking for v4_end_grace
Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly.
We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock.
nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access.
However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held.
So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished.
This resolves a race which can result in use-after-free.
Which versions are affected by CVE-2026-22980?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-22980?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-22980 being exploited?
There is no known exploitation of CVE-2026-22980 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-78458, BELL-CVE-2026-22980, DEBIAN-CVE-2026-22980, GHSA-334x-45wh-5m94, ROOT-OS-DEBIAN-11-CVE-2026-22980, ROOT-OS-DEBIAN-12-CVE-2026-22980 and 4 more.