VulnerabilityPublished 24 Sep 2026Updated 30 Oct 2026

CVE-2026-93231: Linux kernel · lockd: fix swapped arguments in nlmsvc_match_ip()

Source GCVE Database

Compare

Authoritative record:CVE-2026-93231· Medium

Not known to be exploited · fixed in e7124d223c5a2dfb4c1a7b2eea24375edc355a10 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 18:03 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in e7124d223c5a2dfb4c1a7b2eea24375edc355a10, d34c2ac447fe0490ede828e0143e2cbcb59e6c77, cfbf21d21aea1a83d5ff38d50466a655e0a6a31d +5

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-hmpj-ph58-cxj3

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < e7124d223c5a2dfb4c1a7b2eea24375edc355a10	Fixed in e7124d223c5a2dfb4c1a7b2eea24375edc355a10
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < d34c2ac447fe0490ede828e0143e2cbcb59e6c77	Fixed in d34c2ac447fe0490ede828e0143e2cbcb59e6c77
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < cfbf21d21aea1a83d5ff38d50466a655e0a6a31d	Fixed in cfbf21d21aea1a83d5ff38d50466a655e0a6a31d
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < b9060689f49dc663e9a3d069c4a65ff63a836e66	Fixed in b9060689f49dc663e9a3d069c4a65ff63a836e66
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < 68282cbc197b280711f66c4cf05165f911785bcc	Fixed in 68282cbc197b280711f66c4cf05165f911785bcc
LinuxLinux	Affected ≥ 4373ea84c84d8a96e99d3da99e813d3e36d1bd11, < 21bcb609e0ab1dd60f39ca3498f85808933bcc9f	Fixed in 21bcb609e0ab1dd60f39ca3498f85808933bcc9f

AI-suggested

A fix is available that corrects the argument order in nlmsvc_match_ip(). Users should apply the updated Linux kernel version containing this fix to ensure proper lock release behavior. Patch status is not explicitly stated in the input, so verify the vendor advisory for the exact fixed kernel version.

Description

CVE-2026-93231 is a vulnerability in the Linux kernel's lockd component where arguments were swapped in the nlmsvc_match_ip() function. This caused the lock release by server IP address feature to fail because the comparison logic was incorrect, preventing locks from being released as intended.

Impact

Locks associated with a given server IP address are not released as expected due to the argument swap in nlmsvc_match_ip(). This could lead to stale or unreleased locks, potentially impacting system stability or causing resource contention in environments relying on NFS lock management.

Summary

The vulnerability involves swapped arguments in the nlmsvc_match_ip() callback used during lock release by server IP address via /proc/fs/nfsd/unlock_ip. The function nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server sockaddr as opaque data, but nlmsvc_match_ip() reverses the expected argument order. This results in an invalid comparison between the lock owner's source address and the server address, causing the comparison to fail and locks not to be released for the requested IP. The fix swaps the arguments to correctly compare the lock owner's source address against the server address.

References

Community reviews

Loading reviews…