PT-2026-97879

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists in the nfsd file net dispose function. During per-net teardown, the nn-nfsd serv pointer is cleared before the filecache laundrette is shut down. This...

CVE-2026-93211

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures arm64, ppc, a shrinker scan can observe drchashsize before the...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures arm64, ppc, a shrinker scan can observe drchashsize before the...

CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

PT-2026-104977

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd net boolean flags to unsigned long flags word nfsd net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4 end grace guards its drain path with...

CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

PT-2026-97878

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the nfsd component where the shrinker register function is called before the bucket list heads are initialized via the INIT LIST HEAD loop and the drc hashsize...

PT-2026-97888

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the nfsd net structure contains boolean fields accessed from concurrent contexts without proper serialization. Specifically, the nfsd4 end grace function uses a plai...

PT-2026-97896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory barrier issue exists in the nfsd nl rpc status get dumpit function. The implementation of a seqcount-like protocol lacks a read memory barrier smp rmb before the second counter...

SUSE CVE-2026-53393

In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors nfsdvfswrite and nfsdcommit both call filemapcheckwberr to detect deferred writeback errors, but neither rotates the server's write verifier nn-writeverf when this check...

SUSE CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

SUSE CVE-2026-89711

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

SUSE CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

ROS-20260918-73-0125

The vulnerability of the nfsd/netns.h component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-90236

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the...

CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

SUSE CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

SUSE CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...