AZL-101540 CVE-2026-90036 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90037

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

AZL-101642 CVE-2026-90037 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

DEBIAN-CVE-2026-90036

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90039

This Linux kernel vulnerability affects the NFSD subsystem. Writing to /proc/fs/nfsd/unlock_filesystem or sending the NFSD_CMD_UNLOCK_FILESYSTEM/NFSD_CMD_UNLOCK_EXPORT netlink commands walks NFSv4 client hash tables, but the existing guard (nn->nfsd_serv) is set before nn->conf_id_hashtbl i...

CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

EUVD-2026-80647

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90038

A use-after-free in the Linux kernel NFSD component affects nfsd4_revoke_export_states() , which drops nn->client_lock across revoke_one_stid() and a subsequent read of clp->cl_minorversion without pinning the client. A teardown racing the dropped lock can free the client while it is still ...

EUVD-2026-80646

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-90037

CVE-2026-90037 is a use-after-free in the Linux kernel's NFSD (NFS server daemon) component. An nfs4_openowner left on the close_lru list after its final CLOSE holds a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and drops client_lock, a concurrent force_expire_clie...

EUVD-2026-80645

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...

CVE-2026-90036

This is a use-after-free in the Linux kernel NFSD (NFS server daemon) subsystem. A bare lock owner holds a raw pointer to its nfs4_client without a reference keeping the client alive. When the per-net laundromat reaps a blocked lock, the owner reference is dropped via flc_owner, and a concurrent ...

EUVD-2026-80644

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...

CVE-2026-90036 NFSD: Prevent client use-after-free during blocked-lock reaping

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...