Linux Distros Unpatched Vulnerability : CVE-2026-89694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without...

Linux Distros Unpatched Vulnerability : CVE-2026-89669

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linke...

Linux Distros Unpatched Vulnerability : CVE-2026-89684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scploc...

CVE-2026-89669

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

CVE-2026-89684

A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOADCANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a denial of service DoS by causing the server to crash...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

AZL-100653 CVE-2026-89684 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

DEBIAN-CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

AZL-100076 CVE-2026-89669 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

UBUNTU-CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

UBUNTU-CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

UBUNTU-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694

CVE-2026-89694 affects the Linux kernel NFS server (nfsd) on the OFFLOAD_CANCEL path. The function manage_cpntf_state() freed a target copy-notify state without verifying ownership. Because the lookup key (st->si_opaque.so_id) is allocated cyclically (guessable) and the embedded clientid is a ...

EUVD-2026-76606

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

EUVD-2026-76596

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...