CVE-2026-89695: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...

CVE-2026-89692: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89665: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89661: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...

PT-2026-96366

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-96439

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

PT-2026-96575

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache disposal UAF by inlining dispose state into nfsd net nfsd file dispose list delayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of...

CVE-2026-89678: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89679: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89693: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

CVE-2026-89694: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

PT-2026-96338

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff encode getdeviceinfo nfsd4 ff encode getdeviceinfo computes the da addr body reservation as 16 + netid len + addr len, but the subsequent xdr encode opaque calls emit 8 + round upnetid len,...

PT-2026-96430

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc decode setaclargs fills in argp-acl access only when NFS ACL is set in the request mask and argp-acl...

CVE-2026-89664: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

CVE-2026-89667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89672: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

CVE-2026-89673: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...

CVE-2026-89677: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

CVE-2026-89680: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...