CVE-2026-93211 nfsd: initialize DRC hash table before registering shrinker
A race condition in the Linux kernel NFS server can cause a null pointer dereference and system crash when the DRC hash table is accessed before initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93211?
CVE-2026-93211 is a vulnerability in Linux, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize DRC hash table before registering shrinker
shrinker_register() precedes the INIT_LIST_HEAD loop and the drc_hashsize store. On weakly-ordered architectures (arm64, ppc), a shrinker scan can observe drc_hashsize before the bucket list heads are initialized, causing a NULL deref in the DRC shrinker callback.
Move bucket initialization and the drc_hashsize store before shrinker_register() so the hash table is fully initialized before it becomes visible to the shrinker.
Which versions are affected by CVE-2026-93211?
How do I fix CVE-2026-93211?
Apply the vendor's patch.
Is CVE-2026-93211 being exploited?
There is no known exploitation of CVE-2026-93211 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93211, DEBIAN-CVE-2026-93211, GHSA-4vgq-cgvq-hg3w, UBUNTU-CVE-2026-93211.