PT-2026-90386

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the nfsd open local fh function where a pointer is loaded using cmpxchg and subsequently passed to nfsd file get without holding an rcu read lock. Because nfsd...

PT-2026-90398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd file dispose list delayed defers fput to nfsd service threads using a per-net freeme queue stored in a separately...

PT-2026-90399

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A dentry reference leak occurs in the nfsd set fh dentry function during V4ROOT export filehandle lookup. When the NFS3 FHSIZE or NFS FHSIZE switch cases detect NFSEXP V4ROOT and proceed to...

PT-2026-90401

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A clock domain mismatch exists in the clients still reclaiming function. The function calculates a deadline using nn-boot time based on CLOCK REALTIME but compares it against ktime get...

PT-2026-90408

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where the nfsd break one deleg function sets the NFSD4 CALLBACK RUNNING bit to serialize recall work before calling nfsd4 run cb to queue the recall. If...

PT-2026-90395

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A null dereference exists in the nfsd4 setattr function when processing SETATTR requests. If a request includes FATTR4 WORD2 TIME DELEG ACCESS or FATTR4 WORD2 TIME DELEG MODIFY in the...

PT-2026-90397

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A race condition exists in the nfsd component where the workqueue core clears WORK STRUCT PENDING before the callback is invoked. This causes delayed work pending in the lm breaker timedout...

PT-2026-90403

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd file do acquire function where it may use a file that has not been opened. This occurs because the -atomic open handler can return success without opening the...

PT-2026-90411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd4 decode posixacl function where a u32 entry count is read from the wire and passed directly to posix acl alloc and sort pacl range. Because sort pacl range...

PT-2026-90384

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the init nfsd function where nfsd debugfs init is executed before nfsd4 init slabs. If the slab allocation fails, the system returns a value that bypasses nfsd debugfs exi...

PT-2026-90419

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd4 drop revoked stid handles FREE STATEID for admin-revoked delegations but fails to set SC STATUS FREED before...

PT-2026-90374

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel during the cleanup of revoked states in NFSv4.0. The function nfs40 clean admin revoked takes a stateid reference while holding the clp-...

CVE-2026-89691: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

PT-2026-90376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Network File System server NFSD during admin state revocation. The problem occurs because a stateid contains a pointer to the nfs4 client without...

CVE-2026-89681: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

CVE-2026-89688: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89687: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsdfiledoacquire does not use a non-opened file -atomicopen is permitted to return success without actually opening the file. It indicates this by calling finishnoopen. This means dentrycreate can return a file whic...

CVE-2026-89683: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

CVE-2026-89675: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89670: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...