UBUNTU-CVE-2026-93229: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit() is missing a read memory barrier (smprmb) before its second counter check. The standard kernel readseqcountretry() includes smprmb() to ensure that all data reads complete before the counter is re-checked. Without this barrier, on weakly-ordered architectures (ARM, POWER), the CPU may reorder field reads past the second counter check, making the retry logic ineffective: it could observe a consistent counter pair while reading fields that have been concurrently modified by the writer. Add smprmb() before the second counter check to order the field reads ahead of it, matching the barrier semantics of the standard seqcount read-side. The begin-side smploadacquire() already pairs with the smpstorerelease() in nfsddispatch(); with the smprmb() now ordering the field reads, the retry check no longer needs acquire semantics and reads the counter with a plain READONCE(), as readseqcountretry() does. [ cel: Use READONCE instead of smploadacquire() ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In nfsd_nl_rpc_status_get_dumpit(), add smp_rmb() before the second seqcount counter check to order field reads before the retry check, and read the counter there with plain READ_ONCE() instead of smp_load_acquire().