CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server nfsd. An authenticated NFSv4.2 client could exploit a vulnerability in the managecpntfstate function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leadi...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89694

CVE-2026-89694 affects the Linux kernel NFS server (nfsd) on the OFFLOAD_CANCEL path. The function manage_cpntf_state() freed a target copy-notify state without verifying ownership. Because the lookup key (st->si_opaque.so_id) is allocated cyclically (guessable) and the embedded clientid is a ...

EUVD-2026-76606

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

EUVD-2026-76596

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89684

CVE-2026-89684 is a race condition in the Linux kernel's NFS server (nfsd) copy-notification state management. The function nfs4_alloc_init_cpntf_state() published a new cpntf entry into the s2s_cp_stateids IDR in one lock section, then acquired the lock again to add it to the parent's sc_cp_list...

CVE-2026-89684 nfsd: fix cpntf publish race in nfs4_init_cp_state

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

PT-2026-90410

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992451)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992451 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4.2 fix problems with nfs42sscopen A destination server while doing a COPY shouldn't accept...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SLE 15 SP5) (SUSE-SU-2025:3721-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3721-1 advisory. This update for the Linux Kernel 5.14.21-1505005580 fixes several issues. The following security issues were fixed: - CVE-2025-38678: netfilter...

SUSE SLES15 Security Update : kernel (Live Patch 49 for SLE 15 SP3) (SUSE-SU-2025:03671-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03671-1 advisory. This update for the Linux Kernel 5.3.18-15030059179 fixes several issues. The following security issues were fixed: - CVE-2025-38499:...

SUSE SLES15 Security Update : kernel (Live Patch 48 for SLE 15 SP3) (SUSE-SU-2025:03663-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03663-1 advisory. This update for the Linux Kernel 5.3.18-15030059174 fixes several issues. The following security issues were fixed: - CVE-2025-38499:...

EUVD-2020-23180

Malware in sbrugna...

EUVD-2022-55103

Malicious code in bioql PyPI...

CVE-2022-50006

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2 fix problems with nfs42sscopen A destination server while doing a COPY shouldn't accept using the passed in filehandle if its not a regular filehandle. If allocfilepseudo has failed, we need to decrement a reference on th...

CVE-2022-50006

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2 fix problems with nfs42sscopen A destination server while doing a COPY shouldn't accept using the passed in filehandle if its not a regular filehandle. If allocfilepseudo has failed, we need to decrement a reference on th...