2156 matches found
SUSE CVE-2026-90038
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...
SUSE CVE-2026-90039
In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...
EUVD-2026-81829
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...
CVE-2026-90236
CVE-2026-90236 affects the Linux kernel NFSD (NFS server daemon). The bug is a reference-counting flaw in NFSv4 state ID teardown: free_ol_stateid_reaplist() frees open and lock stateids via ->sc_free() without releasing the svc_export reference, unlike nfs4_put_stid(). This pins the export an...
CVE-2026-90236 NFSD: Release the export reference when reaping open stateids
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...
CVE-2026-90236 NFSD: Release the export reference when reaping open stateids
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...
CVE-2026-90236: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...
PT-2026-94584
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Network File System server NFSD where the free ol stateid reaplist function frees open and lock stateids by calling -sc free directly, bypassing the path used by...
Linux Distros Unpatched Vulnerability : CVE-2026-90038
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates h...
SUSE CVE-2026-89549
In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...
SUSE CVE-2026-89784
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...
DEBIAN-CVE-2026-90039
In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...
CVE-2026-90039
In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...
CVE-2026-90038
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...
AZL-101540 CVE-2026-90036 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...
DEBIAN-CVE-2026-90036
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...
CVE-2026-90037
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...
AZL-101642 CVE-2026-90037 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...
CVE-2026-90036
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...
DEBIAN-CVE-2026-90037
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...