UBUNTU-CVE-2026-93221: Critical severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace() guards its drain path with a plain bool: if (nn->graceended) return; nn->graceended = true; The read and the write are independent, and nothing in struct nfsdnet serializes them. At least two contexts can reach this code with no lock held: laundromat path laundrywq kworker nfs4laundromat() nfsd4endgrace() RECLAIMCOMPLETE path nfsd compound kthread nfsd4reclaimcomplete() increclaimcomplete() nfsd4endgrace() Both callers can observe graceended == false on different CPUs, both store true, and both proceed into nfsd4recordgracedone(), which invokes the active clienttrackingops->gracedone callback. For tracking ops that drain reclaimstrhashtbl (legacytrackingops via nfsd4recdirpurgeold, and the cld v1+ ops via nfsd4cldgracedone), gracedone calls nfs4releasereclaim(), which walks every bucket of reclaimstrhashtbl with no lock and calls nfs4removereclaimrecord() (listdel + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4clientreclaim. A concurrent nfsd4findreclaimclient() iterating the same bucket reads through freed memory. A third call site exists in nfs4statestartnet() on the skipgrace startup path, but it runs under nfsdmutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above. Replace the scattered boolean fields in nfsdnet with a single unsigned long flags word and an enum nfsdnetflag for the bit positions. The graceended race is fixed by using testandsetbit(), which is atomic on all architectures. The remaining flags (graceendforced, ingrace, somebodyreclaimed, trackreclaimcompletes, nfsdnetup, lockdup) are converted to use testbit/setbit/clearbit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.