CVE-2026-89539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-89551: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

CVE-2026-89549: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89543: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053242 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssxdecoptionarray The creds and oa-data need to be freed in the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053303)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053303 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gssimportv2context The ctx-mechused.data allocated by kmemdup is not fre...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053407)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053407 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...

SUSE CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

Linux RPC Protocol Heap Buffer Overflow DoS

The vulnerability of the rpcrdmapostrecvs function in the net/sunrpc/xprtrdma/verbs.c module of the Linux operating system’s RPC protocol implementation is related to incorrect resource initialization. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: In the bound-check xdrbuftobvec function, the data is stored before being written. The xdrbuftobvec function writes a biovec into the caller’s array before checking whether that slot is within range. The head branch...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: The pin mechanism for the upper rpcclnt across the TLS-connected connectworker. The TLS connection process involves a use-after-free: Nothing pinning the upper rpcclnt occurs during the delayed connectworker. The xsconnec...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sunrpc: The lifecycle of rqprocinfo has been hardened to prevent double-free operations. The svcreleaserqst function executes the callback within rqstp-rqprocinfo-pcrelease. However, if a worker thread begins processing a new...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed the loop termination condition in gssfreeintokenpages. The intoken-pages array is not NULL-terminated. This results in the following KASAN issue: KASAN: Potential wild-memory-access in the range...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: sunrpc: pin svcxprt during the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core only takes...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fixed the uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sunrpc: When canceling a TLS handshake that is still in progress, there is a race condition where the callback for the ongoing handshake is not properly handled. When waitforcompletioninterruptibletimeout in svctcphandshake retur...

SUSE CVE-2026-72317

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

SUSE CVE-2026-72217

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

SUSE CVE-2026-72220

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a worker thread begins processing a new request and encounters an early...

SUSE CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...