CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

EUVD-2026-76620

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708

CVE-2026-89708 is a use-after-free in the Linux kernel's nfsd (NFS server) component, triggered during NFSv4 session teardown. After a DESTROY_SESSION , the session object can be freed via kfree() while rpciod still holds an in-flight callback rpc_task that dereferences clp->cl_cb_session. A s...

CVE-2026-89569 Bluetooth: RFCOMM: serialize security confirmation handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

EUVD-2026-76480

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89569

CVE-2026-89569 is a use-after-free vulnerability in the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_security_cfm() looks up an RFCOMM session and walks its DLC (data link connection) list without holding rfcomm_mutex , while the krfcommd thread can concurrently tear down and free...

PT-2026-90424

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl cb session to fix use-after-free on session teardown After a DESTROY SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc task that dereferences clp-cl cb...

PT-2026-90351

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd reopen durable fd walks the inode's m op list and rebinds every detached oplock to the reconnecting session: list for each entry rcuop, &ci-m op list, o...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix for conn use after free during resets If we do not perform a unbind target call, we can encounter a race condition where iscsiconnteardown wakes up the EH thread, and then frees the connection while those threads...

EUVD-2026-62671

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

EUVD-2026-59715

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

PT-2026-72974

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in close file table ids A ksmbd file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd lookup fd inode. ksmbd close fd currently marks the file...

Linux Distros Unpatched Vulnerability : CVE-2026-64141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compareguidkey sessionfdcheck walks the per-inode...

CVE-2026-64141

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compareguidkey sessionfdcheck walks the per-inode moplist during durable-handle session teardown and sets op-conn = NULL for every opinfo whose conn matched the closing session's connection...

CVE-2026-64141

Summary (CVE-2026-64141) : In the Linux kernel ksmbd component, a remote attacker could trigger a null pointer dereference after negotiating a new SMB2 session with the same ClientGuid and issuing a CREATE with a lease context on a different inode following a durable-handle session teardown. The ...