EUVD-2026-76621

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89709 lockd, nfsd: RCU-protect nlmsvc_ops dispatch

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89696

CVE-2026-89696 affects the Linux kernel's NFS daemon (nfsd) when CONFIG_NFSD_V4_2_INTER_SSC is enabled. A NULL pointer dereference occurs in the nfsd kthread when a remote, unauthenticated client crafts an NFS COMPOUND request containing an inter-SSC COPY operation with an additional op (e.g., SE...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89679 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

EUVD-2026-76591

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89679

CVE-2026-89679 is a null pointer dereference in the Linux kernel's nfsd component. When an NFSv4 client sends a SETATTR request containing the special "one stateid" (all-0xFF bytes) along with delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY), nfsd...

CVE-2026-89679

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89679 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662

CVE-2026-89662 is a use-after-free vulnerability in the Linux kernel's NFSD (Network File System Daemon) component, triggered during client teardown. A race condition between __destroy_client() and the per-net laundromat (which independently reaps blocked locks) allows a lock owner to be freed wh...

EUVD-2026-76574

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89592

CVE-2026-89592 affects the Linux kernel's accel/rocket driver , specifically the rocket_job_push() function. Two distinct bugs exist: (1) a missing NULL check after a kvmalloc_array() call, which can cause a kernel NULL pointer dereference if the allocation fails; and (2) an integer overflow wher...

CVE-2026-89592 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

EUVD-2026-76504

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

CVE-2026-89592 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

CVE-2026-89570

A lifetime bug in the Linux kernel's CXL (Compute Express Link) MCE notifier can cause NULL dereferences and use-after-free in the MCE handler. The notifier was incorrectly registered per memory device (stored in struct cxl_memdev_state) rather than per region. The fix moves it into struct cxl_re...