CVE-2026-90038

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90039

This Linux kernel vulnerability affects the NFSD subsystem. Writing to /proc/fs/nfsd/unlock_filesystem or sending the NFSD_CMD_UNLOCK_FILESYSTEM/NFSD_CMD_UNLOCK_EXPORT netlink commands walks NFSv4 client hash tables, but the existing guard (nn->nfsd_serv) is set before nn->conf_id_hashtbl i...

EUVD-2026-80647

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

EUVD-2026-80646

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90038

A use-after-free in the Linux kernel NFSD component affects nfsd4_revoke_export_states() , which drops nn->client_lock across revoke_one_stid() and a subsequent read of clp->cl_minorversion without pinning the client. A teardown racing the dropped lock can free the client while it is still ...

CVE-2026-90037

CVE-2026-90037 is a use-after-free in the Linux kernel's NFSD (NFS server daemon) component. An nfs4_openowner left on the close_lru list after its final CLOSE holds a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and drops client_lock, a concurrent force_expire_clie...

EUVD-2026-80645

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90036

This is a use-after-free in the Linux kernel NFSD (NFS server daemon) subsystem. A bare lock owner holds a raw pointer to its nfs4_client without a reference keeping the client alive. When the per-net laundromat reaps a blocked lock, the owner reference is dropped via flc_owner, and a concurrent ...

EUVD-2026-80644

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90036 NFSD: Prevent client use-after-free during blocked-lock reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold a reference to the net structure for the lifetime of the open file descriptor. The /proc/fs/nfs/exports proc entry is created during module initialization and remains valid throughout the lifetime of the module. The...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: fixed a race condition between nfsd registration and exportsproc Currently, nfsd calls createprocexportsentry at the beginning of initnfsd, and cleanup is performed by removeprocentry at the end of exitnfsd. This can lea...

CVE-2026-89661

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...

CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...