PT-2026-90382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the kernel fails to properly validate the nseconds field in NFSv3 SETATTR and create operations CREATE, MKDIR, SYMLINK, or MKNOD. A client can...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

PT-2026-90425

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lockd and nfsd components where nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown using plain stores. Because lockd dereferences this...

CVE-2026-89700: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...

CVE-2026-89677: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

PT-2026-96607

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc ops dispatch nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The...

PT-2026-96484

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow down error nfsd cross mnt initializes a local struct path with mntget and dget before calling follow down. On a negative return the error arm jumps to out without releasing those references: err ...

PT-2026-90421

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd dispatch function where the rq status counter is not consistently restored to an even value on all exit paths. Specifically, cache-hit RC REPLY, drop RC DROPI...

PT-2026-90418

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the nfsd fh verify and nfsd fh verify err tracepoints incorrectly size the server sockaddr slot using xpt remotelen while filling it from xpt...

PT-2026-96366

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-96439

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

CVE-2026-89689: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...

PT-2026-90395

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A null dereference exists in the nfsd4 setattr function when processing SETATTR requests. If a request includes FATTR4 WORD2 TIME DELEG ACCESS or FATTR4 WORD2 TIME DELEG MODIFY in the...

PT-2026-90397

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A race condition exists in the nfsd component where the workqueue core clears WORK STRUCT PENDING before the callback is invoked. This causes delayed work pending in the lm breaker timedout...

PT-2026-90403

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd file do acquire function where it may use a file that has not been opened. This occurs because the -atomic open handler can return success without opening the...

PT-2026-90411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd4 decode posixacl function where a u32 entry count is read from the wire and passed directly to posix acl alloc and sort pacl range. Because sort pacl range...

PT-2026-90380

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nfsd component when processing OPEN compounds. The function nfsd4 decode createhow4 utilizes nfsd4 decode fattr4, which allocates refcounted struct posix acl...

PT-2026-90383

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the filecache of the nfsd component. The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd file from the rhashtable and call nfsd file dispo...

PT-2026-90384

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the init nfsd function where nfsd debugfs init is executed before nfsd4 init slabs. If the slab allocation fails, the system returns a value that bypasses nfsd debugfs exi...

PT-2026-90386

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the nfsd open local fh function where a pointer is loaded using cmpxchg and subsequently passed to nfsd file get without holding an rcu read lock. Because nfsd...