UBUNTU-CVE-2026-93212: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsdfiledisposelistdelayed(). During per-net teardown, nn->nfsdserv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svcserv: nfsd service thread loop nfsdfilenetdispose(nn) if (!listempty(&l->freeme)) { ... svcwakeup(nn->nfsdserv); / nn->nfsdserv == NULL / } The sibling helper nfsdfiledisposelistdelayed() already documents this ordering and caches nn->nfsdserv into a local before testing it for NULL. nfsdfilenetdispose() was introduced with the same raw svcwakeup(nn->nfsdserv) call and never picked up the guard. Fix by loading nn->nfsdserv into a local svcserv pointer and only calling svcwakeup() when it is non-NULL, matching the pattern in nfsdfiledisposelistdelayed().