CVE-2026-89710

CVE-2026-89710 is a layout segment leak in the Linux kernel's NFSv4.1/pNFS subsystem. When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() jumps to out_forget without draining the on-stack free_me list; only the success path calls pnfs_free_lseg_list...

CVE-2026-89707

CVE-2026-89707 affects the Linux kernel nfsd subsystem, specifically the nfsd_cross_mnt() function. The root cause is a missing path_put() call in the error path when follow_down() returns a negative value, leaving the mntget()/dget() references acquired on entry unreleased. The impact is a memor...

CVE-2026-89707 nfsd: release path refs on follow_down() error

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

EUVD-2026-76619

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

EUVD-2026-76614

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89702 nfsd: size fh_verify server sockaddr slot by xpt_locallen

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

EUVD-2026-76610

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89691

CVE-2026-89691 affects the Linux kernel's nfsd (NFS server) component. The root cause is that nfsd4_release_compoundargs() resets args->ops to the inline 8-element iops[] array after freeing the dynamically allocated ops buffer, but fails to clear args->opcnt, which can be up to 200 for NFS...

CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

EUVD-2026-76603

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89683

CVE-2026-89683 affects the Linux kernel 's nfsd subsystem. The flaw is in nfsd_set_fh_dentry(), which leaks a dentry reference obtained from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and jump to the out: label. That label calls exp_put() but nev...

EUVD-2026-76595

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

CVE-2026-89683 nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

EUVD-2026-76593

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

CVE-2026-89680 nfsd: fix nfsd_file leak on inter-server COPY setup failure

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

CVE-2026-89680

CVE-2026-89680 is a resource leak in the Linux kernel's NFS server daemon (nfsd) . When the inter-server COPY setup function nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the cleanup path (out: label) where release_copy_files() would release the nf_...

EUVD-2026-76592

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

EUVD-2026-76586

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

EUVD-2026-76585

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...