PT-2026-96575

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache disposal UAF by inlining dispose state into nfsd net nfsd file dispose list delayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of...

PT-2026-96542

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s cp stateids IDR entry for async COPY For an async COPY, nfsd4 copy called nfs4 init copy state before dup copy fields, so the s2s cp stateids IDR was pointed at &u-copy-cp stateid -- memory in the per-rqstp...

CVE-2026-89667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89678: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89679: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

PT-2026-90427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Network File System Daemon NFSD where the nfsd mode check function contains a flawed WARN ON ONCE macro. In scenarios involving NFS reexport, the function may...

PT-2026-96604

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

CVE-2026-89709: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89711: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

PT-2026-90417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the xdrgen-based TIME DELEG ACCESS and TIME DELEG MODIFY decode arms store a raw uint32 t nseconds directly into tv nsec without verifying tha...

CVE-2026-89659: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

PT-2026-96424

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4 client and does not keep it alive. The client survives its stateids only because destroy client drains...

PT-2026-96469

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

PT-2026-90382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the kernel fails to properly validate the nseconds field in NFSv3 SETATTR and create operations CREATE, MKDIR, SYMLINK, or MKNOD. A client can...

PT-2026-90375

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the NFSD Network File System Daemon delegation handling. The problem occurs because nfs4 laundromat unhashes an expired delegation from cl delegations an...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

PT-2026-90425

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lockd and nfsd components where nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown using plain stores. Because lockd dereferences this...

CVE-2026-89700: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...

CVE-2026-89677: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

PT-2026-96607

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc ops dispatch nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The...