CVE-2026-93211: nfsd: initialize DRC hash table before registering shrinker
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize DRC hash table before registering shrinker
shrinkerregister() precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures (arm64, ppc), a shrinker scan can observe drchashsize before the bucket list heads are initialized, causing a NULL deref in the DRC shrinker callback.
Move bucket initialization and the drchashsize store before shrinkerregister() so the hash table is fully initialized before it becomes visible to the shrinker.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Linux systems running the kernel NFS server (nfsd) are relevant. The race is specifically described on weakly ordered architectures, including arm64 and PowerPC (ppc).
What condition triggers the failure?
A shrinker scan must run after the shrinker is registered but before the DRC hash-table bucket list heads have been initialized. In that window, the scan can observe the hash-size value and dereference an uninitialized bucket list head, causing a NULL-pointer dereference in the DRC shrinker callback.
How can the issue be mitigated if the kernel cannot be updated immediately?
The provided information does not identify a configuration workaround. The described fix is to ensure the DRC hash-table buckets and hash-size value are initialized before registering the shrinker.