CVE-2026-93229: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93229 is a missing read memory barrier vulnerability in the Linux kernel's NFSD (NFS server daemon) subsystem, specifically in the nfsd_nl_rpc_status_get_dumpit() function's hand-rolled seqcount-like protocol. The flaw was published on September 24, 2026, and affects Linux kernel versions starting from commit bd9d6a3efa97 (introduced in kernel 6.7) up to the respective fix commits across stable branches. Fixed versions include kernel 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, EUVD).

The root cause is a missing smp_rmb() (read memory barrier) before the second counter check in the seqcount-like retry loop within nfsd_nl_rpc_status_get_dumpit(), classifiable as CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) or a memory ordering defect. On weakly-ordered CPU architectures such as ARM and POWER, the CPU's out-of-order execution engine may reorder field reads past the second counter check, rendering the retry logic ineffective — the function could observe a consistent counter pair while simultaneously reading fields being modified by a concurrent writer. The fix adds smp_rmb() before the second counter check and replaces the begin-side smp_load_acquire() with a plain READ_ONCE(), matching the semantics of the standard kernel read_seqcount_retry() (Feedly, Kernel Stable).

Successful exploitation on vulnerable weakly-ordered architectures (ARM, POWER) can allow a local, low-privileged attacker to read inconsistent or partially-updated NFS RPC status fields, leading to a high confidentiality impact (exposure of in-flight NFS RPC data) and high availability impact (potential system instability or crash due to corrupted state reads). Integrity is not directly affected. The scope is limited to the local system running the NFSD subsystem, with no lateral movement potential inherent to this vulnerability (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-93229. The vulnerability requires local access with low privileges and is architecture-specific (ARM, POWER), significantly limiting its practical exploitability. The EPSS score is approximately 0.00125 (very low probability of exploitation), and it is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Update the Linux kernel to a patched version: 6.12.109 or later (for the 6.12.x branch), 6.18.50 or later (for the 6.18.x branch), 7.2.4 or later (for the 7.2.x branch), or 7.3-rc1 and later. No configuration-based workaround is available; the fix requires a kernel update. Systems not running the NFSD subsystem (i.e., not acting as NFS servers) or not using ARM/POWER architectures are at significantly reduced risk (Feedly, Kernel Stable).