CVE-2026-89699

CVE-2026-89699 is a denial-of-service vulnerability in the Linux kernel's nfsd (Network File System Daemon). The function nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NFSv4 symlink targets, allowing a remote, unauthenticated attacker to force a kmalloc of up to several ...

CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89698

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89698

CVE-2026-89698 is a Linux kernel vulnerability in the NFS daemon (nfsd) generic netlink interface. The rq_daddr and rq_saddr fields in struct nfsd_genl_rqstp are declared as struct sockaddr (16 bytes), but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 * (28 bytes) when an I...

EUVD-2026-76610

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

EUVD-2026-76608

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89697

CVE-2026-89697 is a CRITICAL (CVSS 9.1) vulnerability in the Linux kernel's nfsd (NFS Daemon). In nfsd_proc_setattr(), the BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without ...

EUVD-2026-76609

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89696

CVE-2026-89696 affects the Linux kernel's NFS daemon (nfsd) when CONFIG_NFSD_V4_2_INTER_SSC is enabled. A NULL pointer dereference occurs in the nfsd kthread when a remote, unauthenticated client crafts an NFS COMPOUND request containing an inter-SSC COPY operation with an additional op (e.g., SE...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89697

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

EUVD-2026-76607

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...