CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When setting file attributes using nfsdprocsetattr, a specific code path BOTHTIMESET branch prematurely verifies file handles. This bypasses a critical write verification step fhwantwrite, allowing file attribute changes to...

CVE-2026-89682

A flaw was found in the Linux kernel's NFS daemon nfsd component. The nfsdfiledisposelistdelayed function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespace teardown, this structure can be prematurely freed. This allows...

DEBIAN-CVE-2026-89703

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SCSTATUSFREED in nfsd4droprevokedstid for delegations nfsd4droprevokedstid handles FREESTATEID for admin-revoked delegations but does not set SCSTATUSFREED before releasing cllock. revokedelegation uses this flag to...

AZL-100671 CVE-2026-89696 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

AZL-100091 CVE-2026-89673 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...

CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

DEBIAN-CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

AZL-100740 CVE-2026-89609 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

DEBIAN-CVE-2026-89549

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

EUVD-2026-76617

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89704 nfsd: sample writeback error cursor before async COPY loop

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89685

CVE-2026-89685 is a clock domain mismatch in the Linux kernel's NFS daemon (nfsd) . The function clients_still_reclaiming() derives its grace-period deadline from nn->boot_time (CLOCK_REALTIME , ~1.7 billion seconds) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME , second...

CVE-2026-89680

CVE-2026-89680 affects the Linux kernel's nfsd (NFS server daemon) component. When nfsd4_setup_inter_ssc() fails during an inter-server COPY operation, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the cleanup path (out: label) where release_copy_files() would release the destina...

CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89677

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

CVE-2026-89676 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...