PT-2026-90400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the nfsd component during the publication of cpntf entries in nfs4 init cp state. The function nfs4 alloc init cpntf state publishes a new entry into the s2s c...

PT-2026-90414

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where struct nfsd genl rqstp declares rq daddr and rq saddr as 16-byte struct sockaddr fields. When an IPv6 NFS client connects, the nfsd genl rpc...

PT-2026-90422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the write verifier is not rotated when an asynchronous COPY writeback fails. During an async COPY operation, the system captures the...

PT-2026-90377

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel's NFSD component. A local administrator with CAP SYS ADMIN privileges can trigger this by stopping the server and writing a filesystem...

CVE-2026-89661: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...

CVE-2026-89681: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

CVE-2026-89687: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsdfiledoacquire does not use a non-opened file -atomicopen is permitted to return success without actually opening the file. It indicates this by calling finishnoopen. This means dentrycreate can return a file whic...

CVE-2026-89675: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89670: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89701: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89692: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

PT-2026-90416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB read occurs in the Linux kernel when a caller with CAP NET ADMIN privileges sends a 16-byte NFSD A SOCK ADDR with sa family set to AF INET6. This is possible because...

CVE-2026-89682: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89664: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

PT-2026-90424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component during session teardown. After a DESTROY SESSION operation, the teardown path may free a session while the rpciod still holds an...

PT-2026-96347

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl cb session to fix use-after-free on session teardown After a DESTROY SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc task that dereferences clp-cl cb...

PT-2026-90390

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd4 ff encode layoutget function regarding XDR buffer size calculation. Errors in calculating the length of the file handle fh len, user ID uid, group ID gid, and...

PT-2026-90394

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd direct write function where partial-write detection is flawed. The function iterates through write segments and uses vfs iocb iter write to perform writes...

CVE-2026-89684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...