CVE-2026-89667

A flaw was found in the Linux kernel's Network File System Daemon nfsd file caching mechanism. A race condition can occur during concurrent shutdown operations and file disposal, where a file might be unhashed and moved to a dispose list, but the shutdown process misses it. This can lead to a...

CVE-2026-89692

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. This vulnerability occurs when a delegation recall operation fails, leaving a critical internal flag uncleared. This prevents subsequent attempts to break the same delegation, leading to a denial of service where file...

CVE-2026-89713

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A remote attacker, by sending a crafted file attribute modification request SETATTR while a file is being concurrently appended, could exploit a time-of-check to time-of-use TOCTOU vulnerability. This could lead to the...

CVE-2026-89689

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. A remote attacker could exploit a use-after-free vulnerability in the nfsd4sequence function. This occurs when the system attempts to reduce the number of active session slots while a client is still using one of the slo...

CVE-2026-89665

A flaw was found in the Linux kernel's nfsd component. A remote attacker could exploit this vulnerability by sending a specially crafted NFSv2 SETATTR or CREATE request with an out-of-range 'useconds' value. This could lead to incorrect timestamps being written to the filesystem, resulting in dat...

CVE-2026-89662

A flaw was found in the Linux kernel's Network File System Daemon NFSD. During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can result in a NULL dereference, potentially causing a system crash...

CVE-2026-89703

A flaw was found in the nfsd component of the Linux kernel. The nfsd4droprevokedstid function, which handles admin-revoked delegations, fails to correctly set a status flag before releasing a lock. This oversight can lead to a use-after-free condition when a freed delegation is incorrectly added ...

CVE-2026-89702

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When processing NFSv2/v3-over-UDP requests, the nfsdfhverify and nfsdfhverifyerr tracepoints incorrectly size a memory buffer. This can lead to an out-of-bounds write, potentially allowing a remote attacker to cause a denial ...

CVE-2026-89708

A flaw was found in the Linux kernel's NFS daemon nfsd. During the teardown of an NFSv4 session, a race condition can occur where the session's memory is freed while an active callback task still holds a reference to it. This can lead to a use-after-free vulnerability, potentially causing system...

CVE-2026-89700

A flaw was found in the Linux kernel's nfsd component. A local user with CAPNETADMIN capabilities can exploit this by sending a specially crafted network attribute with an incorrect address family length. This can lead to an out-of-bounds read, potentially disclosing sensitive information or...

CVE-2026-89707

A flaw was found in the Linux kernel's nfsd component. An authenticated Network File System NFS client can exploit this vulnerability by triggering a failed cross-mount operation through nfsdlookupdentry or the NFSv4 READDIR encode path. This leads to a reference count leak, which inflates mntcou...

CVE-2026-89549

A flaw was found in the sunrpc component of the Linux kernel. When the nfsd service runs with fewer threads than available pools, a transport can be routed to a pool with no active threads. This prevents the connection from being processed, causing it to hang indefinitely. This can lead to a Deni...

CVE-2026-89696

A flaw was found in the Linux kernel's Network File System NFS daemon nfsd. A remote client can exploit this by sending a specially crafted NFS COMPOUND request. This request, when processed, can lead to a NULL pointer dereference in the nfsd kthread, causing the system to crash and resulting in ...

CVE-2026-89681

A flaw was found in the Linux kernel's nfsd component. A race condition in the layout fence worker can cause a double-reference to a layout stateid. This occurs because the workqueue core clears a pending flag prematurely, allowing a new worker to be scheduled while another is still active. The...

CVE-2026-89671

A flaw was found in the Linux kernel's Network File System version 3 NFSv3 server daemon nfsd. The nfsd3procsetacl function unconditionally processes Access Control List ACL update requests, even when the client's request does not specify an ACL to be set. A remote attacker could exploit this by...

CVE-2026-89691

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. The nfsd4releasecompoundargs function does not properly clear an internal counter opcnt when releasing a buffer. This oversight can lead to an out-of-bounds read, allowing an attacker to access adjacent memory and...

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89695

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The nfsd4decodeposixacl function, responsible for decoding POSIX Access Control Lists ACLs, does not properly cap the entry count received from a client. A remote attacker can exploit this by sending a specially crafted ACL...

CVE-2026-89706

A flaw was found in the Linux kernel's nfsd component. When an asynchronous async copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made durable, resulting in the silent loss of data that was intend...

CVE-2026-89661

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlockfilesystem after the NFSD server has shut down. This can lead to memory corruption, potentially...