CVE-2026-22980: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22980 is a use-after-free vulnerability in the Linux kernel's NFSv4 grace period handling (nfsd: provide locking for v4_end_grace). Writing to v4_end_grace can race with server shutdown, causing memory — particularly reclaim_str_hashtbl — to be accessed after it has been freed. The vulnerability was published on January 23, 2026, and affects Linux kernel versions from 3.18 through multiple stable branches up to 6.18.x. It carries a CVSS v3.1 base score of 7.8 (High), assigned by kernel.org (Red Hat Advisory, Microsoft MSRC).

The root cause is a race condition (CWE-416: Use After Free) in the Linux kernel's NFSD subsystem. When v4_end_grace is written concurrently with server shutdown, the nfsd4_end_grace() function can access reclaim_str_hashtbl memory that has already been freed during the shutdown sequence. The fix introduces two new nfsd_net fields — client_tracking_active (protected by nn->client_lock spinlock) and grace_end_forced — ensuring that the laundromat work queue is only scheduled while it is safe to make client tracking calls, and that writing to v4_end_grace cannot restart work items after shutdown has already waited for them. The vulnerability requires local access with low privileges and no user interaction to trigger (Red Hat Advisory, Feedly).

Successful exploitation by a low-privileged local attacker can crash NFSv4 services or cause broader system instability through memory corruption. The CVSS assessment indicates high impact to confidentiality, integrity, and availability, meaning an attacker could potentially read sensitive kernel memory, corrupt data structures, or cause a denial of service. Systems acting as NFSv4 servers are most directly at risk, and instability could affect all clients relying on those services (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.024%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities (Feedly).

Patches have been released across all affected stable kernel branches. Administrators should upgrade to the following minimum versions based on their deployment:

• 5.10.x: 5.10.248 or later
• 5.11.x–5.14.x: 5.15.198 or later
• 5.16.x–6.0.x: 6.1.161 or later
• 6.2.x–6.5.x: 6.6.121 or later
• 6.7.x–6.11.x: 6.12.66 or later
• 6.13.x–6.17.x: 6.18.6 or later

For systems that cannot be patched immediately, consider disabling NFSv4 services if they are not operationally critical, and restrict local user access to minimize exposure. Patches are available via kernel.org git commits and Red Hat/Ubuntu/Oracle advisories (Red Hat Advisory, Microsoft MSRC, Ubuntu USN-8278-1).

The vulnerability received standard coverage from Linux distribution security teams, with Red Hat, Ubuntu, Oracle Linux, SUSE, Amazon Linux, and Yocto Project all issuing advisories or patches. Microsoft also acknowledged the vulnerability in its MSRC portal in the context of its CBL-Mariner/Azure Linux kernel. No notable independent researcher commentary or significant social media discussion beyond routine CVE tracking was observed (Red Hat Advisory, Microsoft MSRC, Ubuntu USN-8278-1).