CVE-2026-89659

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This use-after-free vulnerability occurs during the delegation revoke process. When an expired delegation is unhashed, a timing window exists where the client can be prematurely freed before the revocation is complete. This c...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-89686

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89686

nfsd in the Linux kernel contains a race condition in nfsd4_alloc_layout_stateid. When the parent stateid is a delegation, the function reads fp->fi_deleg_file without holding fi_lock. A concurrent delegation revoke via the laundromat can clear this pointer, causing nfsd_file_get() to return N...

EUVD-2026-76598

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89659 NFSD: Prevent client use-after-free during delegation revoke

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

CVE-2026-89659

A use-after-free vulnerability exists in the Linux kernel's NFSD (NFSv4 server) subsystem during delegation revocation. A delegation stateid holds only a bare pointer to its owning nfs4_client without keeping it alive. The nfs4_laundromat() function breaks the safety invariant: it unhashes an exp...

EUVD-2026-76571

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

PT-2026-90375

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4 client and does not keep it alive. The client survives its stateids only because destroy client drains...

PT-2026-90402

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG ON in nfsd4 alloc layout stateid on racing delegation revoke nfsd4 alloc layout stateid reads fp-fi deleg file without holding fi lock when the parent stateid is a delegation. A concurrent delegation revoke via the...

Linux Distros Unpatched Vulnerability : CVE-2025-39688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SCSTATUSFREEABLE when searching via nfs4lookupstateid The pynfs DELEG8 test fail...