CVE-2026-98250 nfsd: fix handling of NFSEXP_PNFS in the netlink codepath

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

CVE-2026-98250

The Linux kernel contains a vulnerability in nfsd related to the handling of NFSEXP_PNFS within the netlink codepath . The issue arose because a previous rework of block layout checks moved the NFSEXP_PNFS check out of nfsd4_setup_layout_type() into its callers, but that patch failed to account f...

CVE-2026-98250

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

EUVD-2026-93178

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

PT-2026-106579

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the netlink codepath of the nfsd component regarding the handling of NFSEXP PNFS. A rework of block layout checks moved the NFSEXP PNFS verification from the nfsd4 setup...

CVE-2026-98250: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

ROS-20261006-73-0140

The vulnerability of the NFSD component in the Linux operating system’s kernel is related to the dereferencing of a pointer whose expiration time has expired. Exploiting this vulnerability can allow an attacker to trigger a service failure...

CVE-2026-90236

A flaw was found in the Network File System Daemon NFSD of the Linux kernel. This vulnerability occurs due to an improper handling of export references when reaping open state IDs. An unreleased reference can pin an export, preventing the file system from being unmounted. This could allow a local...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: fixed a race condition between nfsd registration and exportsproc Currently, nfsd calls createprocexportsentry at the beginning of initnfsd, and cleanup is performed by removeprocentry at the end of exitnfsd. This can lea...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: The issue in nfsd4setclientidconfirm where the function does not check the return value from getclientlocked was addressed. In this case, a SETCLIENTIDCONFIRM operation might race with a confirmed client’s expiration, causi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: Prevent lock owners from being used after free during client teardown destroyclient releases a client’s open owners. However, a lock owner whose only reference is a blocked lock nbl remains on clownerstrhashtbl...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Restarting the sscexpireumount walk after dropping the nfsdssclock The nfsd4sscexpireumount function iterates over the nn-nfsdsscmountlist using listforeachentrysafeni, tmp, .... For each expired entry, it sets nsuibusy =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the XDR length calculation in nfsd4ffencodelayoutget. The XDR buffer size calculation in nfsd4ffencodelayoutget contains multiple errors that can lead to either an out-of-bounds write or the leakage of uninitialize...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: Check the client ownership when canceling a copy-notify stateid. On the OFFLOADCANCEL path clp != NULL, the managecpntfstate function freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: A sample writeback error occurred when the COPY loop executed asynchronously. The function nfdscopyfilerange records the value dst-fwberr after the copy operation, and then uses this value to detect writeback errors via...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Map EBADMSG to nfserrio to avoid warnings. Ext4 will throw -EBADMSG during ext4readdir when a checksum error occurs, resulting in the following warning. Fix this by mapping EBADMSG to nfserrio. nfsdbufferedreaddir...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold a reference to the net structure for the lifetime of the open file descriptor. The /proc/fs/nfs/exports proc entry is created during module initialization and remains valid throughout the lifetime of the module. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: The free copynotify stateid in nfs4freeolstateid has been fixed. Typically, the copynotify stateid is freed either when the parent’s stateid is being closed/freed, or in nfsd4laundromat if the stateid has not been used duri...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: The stateids used for copy-notify were revoked before their references were dropped. The stateids used for copy-notify are located in the s2scpstateids IDR and on their parent stid’s sccplist, and are pinned by a single...