CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2026-89549

A flaw was found in the sunrpc component of the Linux kernel. When the nfsd service runs with fewer threads than available pools, a transport can be routed to a pool with no active threads. This prevents the connection from being processed, causing it to hang indefinitely. This can lead to a Deni...

CVE-2026-89551

A flaw was found in the Linux kernel's SUNRPC subsystem, specifically within the xdrbuftrim function. This vulnerability occurs when xdrbuftrim attempts to reduce the size of an XDR buffer. If the buffer's length is smaller than the amount being trimmed, an integer underflow can occur, causing th...

CVE-2026-89536

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call client TLS Transport Layer Security handshake process. A race condition exists where a reference to the lower transport can be prematurely released during handshake cancellation. This can lead to memory corruption, potentiall...

CVE-2026-89542

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call implementation. This vulnerability, located in the gsskrb5unwrapv2 function, arises when the system processes specially crafted short tokens or tokens with an invalid length. An attacker could exploit this by providing such a...

CVE-2026-89541

A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the gssunwrapresppriv function within the SUNRPC component. This flaw occurs when validating the length of RPCSECGSS opaque data. A malicious krb5p Network File System NFS server can send a specially...

CVE-2026-89546

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call Network File System NFS callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource leak. This issue could also result in a use-after-free...

CVE-2026-89545

A flaw was found in the Linux kernel. This vulnerability exists within the sunrpc component, where memory associated with rqargp and rqresp is freed prematurely. Specifically, the svcrqstfree function frees these structures synchronously, while the main request structure rqstp is freed later via...

CVE-2026-89540

A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the gssplock mutex is not initialized before its associated /proc/net/rpc/use-gss-proxy entry is published. This allows a local attacker to trigger a scenario where multiple writers can concurrently access the...

CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauthgss module. A remote attacker could send a specially crafted Kerberos krb5 token with an insufficient length. This could lead to a division-by-zero error within the gsskrb5unwrapv2 function, resulting in a Denial of Service DoS for the affected...

CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...

CVE-2026-89547

A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently...

CVE-2026-89544

A flaw was found in the Linux kernel's SUNRPC component. Multiple defects in the gssxdecoptionarray XDR option-array decoder's error handling can lead to a NULL dereference, a reference count leak, and a use-after-free vulnerability. An attacker could potentially exploit these issues by providing...

CVE-2026-89543

A flaw was found in the kernel's sunrpc component. A use-after-free vulnerability can occur due to improper handling of clnt-pipefssb pointers during mount and unmount events. This can lead to stale pointers, which, when accessed, may result in a system crash Denial of Service...

AZL-100103 CVE-2026-89547 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

DEBIAN-CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89551

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...