DEBIAN-CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

DEBIAN-CVE-2026-89549

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

DEBIAN-CVE-2026-89551

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

DEBIAN-CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

AZL-100776 CVE-2026-89550 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

DEBIAN-CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

AZL-100103 CVE-2026-89547 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89551

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

CVE-2026-89549

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

DEBIAN-CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

AZL-100280 CVE-2026-89545 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

AZL-100283 CVE-2026-89543 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

DEBIAN-CVE-2026-89540

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...

DEBIAN-CVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

AZL-100515 CVE-2026-89542 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

AZL-100656 CVE-2026-89544 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

AZL-100877 CVE-2026-89541 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

DEBIAN-CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...