PT-2026-90386

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the nfsd open local fh function where a pointer is loaded using cmpxchg and subsequently passed to nfsd file get without holding an rcu read lock. Because nfsd...

PT-2026-90398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd file dispose list delayed defers fput to nfsd service threads using a per-net freeme queue stored in a separately...

PT-2026-90399

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A dentry reference leak occurs in the nfsd set fh dentry function during V4ROOT export filehandle lookup. When the NFS3 FHSIZE or NFS FHSIZE switch cases detect NFSEXP V4ROOT and proceed to...

PT-2026-90401

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A clock domain mismatch exists in the clients still reclaiming function. The function calculates a deadline using nn-boot time based on CLOCK REALTIME but compares it against ktime get...

PT-2026-90408

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where the nfsd break one deleg function sets the NFSD4 CALLBACK RUNNING bit to serialize recall work before calling nfsd4 run cb to queue the recall. If...

CVE-2026-89675: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89702: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89685: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

CVE-2026-89704: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

K000163298: Linux kernel vulnerability CVE-2026-53397

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak on SETACL decode failure nfsaclsvcdecodesetaclargs and nfs3svcdecodesetaclargs each call nfsstreamdecodeacl twice, first for NFSACL and then for NFSDFACL. Each successful call...

K000163276: Linux kernel vulnerability CVE-2026-53399

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When...

K000163273: Linux kernel vulnerabilities CVE-2026-53393 and CVE-2026-53398

Security Advisory Description CVE-2026-53393 In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors nfsdvfswrite and nfsdcommit both call filemapcheckwberr to detect deferred writeback errors, but neither rotates the server's...

Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-081025)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-081025 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proclayoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client shou...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053221)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053221 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has...

Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-085343)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-085343 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svcxprtput on rpccreate failure On error situation...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073365)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073365 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into...

kernel: nfsd: fix posix_acl leak on SETACL decode failure

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability occurs during the processing of Access Control List ACL set operations. If a specific decode step fails, a memory leak of a posixacl object occurs. This can lead to resource exhaustion over time, potentiall...

kernel: nfsd: release layout stid on setlease failure

A use-after-free flaw was found in the Linux kernel's NFS daemon nfsd pNFS layout handling. When nfsd4layoutsetlease fails, the layout stateid that was already published in the client IDR is freed directly, leaving a stale pointer in the IDR. A subsequent IDR traversal, such as statesshow or clie...

kernel: nfsd: fix posix_acl leak on SETACL decode failure

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability occurs during the processing of Access Control List ACL set operations. If a specific decode step fails, a memory leak of a posixacl object occurs. This can lead to resource exhaustion over time, potentiall...

kernel: nfsd: release layout stid on setlease failure

A use-after-free flaw was found in the Linux kernel's NFS daemon nfsd pNFS layout handling. When nfsd4layoutsetlease fails, the layout stateid that was already published in the client IDR is freed directly, leaving a stale pointer in the IDR. A subsequent IDR traversal, such as statesshow or clie...