---
id: CVE-2026-93211
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: initialize DRC hash table before registering shrinker

  shrinker_register() precedes the INIT_LIST_HEAD loop and the
  drc_hashsize store
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: initialize DRC hash table before registering shrinker

  shrinker_register() precedes the INIT_LIST_HEAD loop and the
  drc_hashsize store. On weakly-ordered architec…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 <
    f060f43a67635dbb393bf5dcbfc3e8b9a44942cb
  - >-
    Linux >= 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 <
    b57bd8cb739cb3cf88bdb1a5903a42a707a5c282
  - >-
    Linux >= 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 <
    431c70ca5163c98c746f22f16cd58ca5aefec6dc
  - >-
    Linux >= 8eea99a81c6f67c08fedd7db2ccd09aa93db69a7 <
    b0c58934f5cc4f05b63ef6605dd10c1d0d489e88
  - Linux 6.7
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:16.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93211'
references:
  - url: 'https://git.kernel.org/stable/c/431c70ca5163c98c746f22f16cd58ca5aefec6dc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b0c58934f5cc4f05b63ef6605dd10c1d0d489e88'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b57bd8cb739cb3cf88bdb1a5903a42a707a5c282'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f060f43a67635dbb393bf5dcbfc3e8b9a44942cb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T15:45:56.671Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: initialize DRC hash table before registering shrinker

shrinker_register() precedes the INIT_LIST_HEAD loop and the
drc_hashsize store. On weakly-ordered architectures (arm64, ppc),
a shrinker scan can observe drc_hashsize before the bucket list
heads are initialized, causing a NULL deref in the DRC shrinker
callback.

Move bucket initialization and the drc_hashsize store before
shrinker_register() so the hash table is fully initialized before
it becomes visible to the shrinker.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.