CVE-2026-89715

CVE-2026-89715 is a reference leak in the Linux kernel NFS/localio subsystem. When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing the RCU pointer. The error path in nfs_open_local_fh() then leaks a caller-owned nfsd_file reference (pi...

CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89716 zram: validate deflate params

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

EUVD-2026-76627

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89716

CVE-2026-89716 affects the Linux kernel's zram module. User-supplied deflate winbits are passed to zlib_deflate_workspacesize() without validation; if the value falls outside the valid range, a BUG_ON() is triggered, resulting in a kernel bug/panic. The fix validates the winbits parameter before ...

CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

CVE-2026-89715 NFS/localio: fix ref leak on nfs_uuid_add_file failure

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89716 zram: validate deflate params

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

EUVD-2026-76628

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

CVE-2026-89715 NFS/localio: fix ref leak on nfs_uuid_add_file failure

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

EUVD-2026-76626

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

CVE-2026-89714

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

CVE-2026-89714

This Linux kernel vulnerability affects the NFSv4 client subsystem. The root cause is a memory leak of server->delegation_hash_table (4 KiB per attempt with the default delegation watermark) when nfs4_server_common_setup() fails at an intermediate step (is_ds_only_client(), nfs4_init_session()...

CVE-2026-89712 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89712 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89713

A TOCTOU race condition in the Linux kernel's NFS Daemon (NFSD) component allows a remote, unauthenticated attacker to bypass append-only file protections. In nfsd_setattr(), the NFSD_MAY_TRUNC permission check samples the file size without holding inode_lock(), but the actual size update is appl...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...