CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89677

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

CVE-2026-89676 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

PT-2026-90407

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...

USN-8725-1 linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - NVIDIA Tegra memory controller driver; - File systems infrastructure; - Network file system NFS server daemon; -...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098744)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098744 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check this is a v4 compound request If the request being processed i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098700 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the...

Astra Linux – Vulnerability in Linux 5.15

The Linux kernel’s NFSD implementation before versions 5.19.17 and 6.0.2 is vulnerable to buffer overflow attacks. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call RPC into a single array of pages. A client can force the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed an UAF in svctcplistendataready After the listener svcsock is freed, and before invoking svctcpaccept for the established child sock, there is a window during which the newsock may retain the freed listener svcsock ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the startup race issue with nsfd again. The commit bd5ae9288d64 "nfsd: register pernet ops last, unregister first" re-opened the race in rpcpipefsevent, which was related to the registration of nfsdnetid using...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Cleanup of potential nfsdfile refcount leaks in the COPY code path. There are two different versions of the nfsd4copy structure. One is embedded within the compound structure and is used directly in synchronous copies. T...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: Cancel nfsdshrinkerwork using sync mode in nfs4stateshutdownnet In the normal case, when we execute echo 0 /proc/fs/nfsd/threads, the function nfs4statedestroynet in nfs4stateshutdownnet will release all resources related t...

CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

CVE-2026-53393

A flaw was found in the Linux kernel's Network File System NFS daemon. This vulnerability occurs when the NFS daemon fails to reset the write verifier during deferred writeback errors for UNSTABLE writes. A remote attacker, acting as an NFS client, could exploit this by performing operations that...

CVE-2026-53396

A flaw was found in the Linux kernel's Network File System NFS daemon nfsd within the nfsd4createfile function. This vulnerability allows a remote attacker to cause a denial of service DoS by repeatedly triggering a memory leak of posixacl allocations. The leak occurs when a client attempts to...

SUSE CVE-2026-53398

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

CVE-2026-53398

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

CVE-2026-53396

CVE-2026-53396 (Linux kernel, NFSd) : The issue arises in nfsd4_create_file() where two ACL-handling bugs allow potential ACL leakage and incorrect behavior on CREATE. Specifically, the return value of nfsd4_acl_to_attr() is discarded, so failed ACL conversions (e.g., -EINVAL for unsupported ACE ...