PT-2026-90424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component during session teardown. After a DESTROY SESSION operation, the teardown path may free a session while the rpciod still holds an...

CVE-2026-89704: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

PT-2026-90416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB read occurs in the Linux kernel when a caller with CAP NET ADMIN privileges sends a 16-byte NFSD A SOCK ADDR with sa family set to AF INET6. This is possible because...

PT-2026-90423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the nfsd cross mnt function when follow down returns a negative value. The function initializes a local path structure using mntget and dget, but fails to call...

CVE-2026-89659: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

CVE-2026-89711: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

CVE-2026-89705: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

PT-2026-96424

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4 client and does not keep it alive. The client survives its stateids only because destroy client drains...

CVE-2026-89666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89674: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

CVE-2026-89707: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

PT-2026-90419

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd4 drop revoked stid handles FREE STATEID for admin-revoked delegations but fails to set SC STATUS FREED before...

PT-2026-90418

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the nfsd fh verify and nfsd fh verify err tracepoints incorrectly size the server sockaddr slot using xpt remotelen while filling it from xpt...

PT-2026-96525

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4 init cp state nfs4 alloc init cpntf state published the new cpntf entry into the s2s cp stateids IDR with cs type set in one s2s cp lock section, then took the lock again to list add it onto p...

CVE-2026-89691: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

PT-2026-96542

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s cp stateids IDR entry for async COPY For an async COPY, nfsd4 copy called nfs4 init copy state before dup copy fields, so the s2s cp stateids IDR was pointed at &u-copy-cp stateid -- memory in the per-rqstp...

CVE-2026-89676: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

PT-2026-90392

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where nfsd4 copy calls nfs4 init copy state before dup copy fields during an async COPY operation. This causes the s2s cp stateids IDR to point to memor...

PT-2026-90377

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel's NFSD component. A local administrator with CAP SYS ADMIN privileges can trigger this by stopping the server and writing a filesystem...

CVE-2026-89661: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...