CVE-2026-89547: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89532: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

CVE-2026-89538: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

CVE-2026-89539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-89536: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

CVE-2026-89541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89545: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89548: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89540: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...

CVE-2026-89542: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

CVE-2026-89551: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

PT-2026-96570

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp lock before publishing proc entry create use gss proxy proc entry publishes /proc/net/rpc/use-gss-proxy via proc create data before init gssp clnt runs mutex init on sn-gssp lock. Once the dentry is linked under...

PT-2026-96555

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache cleaner before destroying a cache detail sunrpc destroy cache detail only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty...

PT-2026-96529

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS VALUE options gssx dec option array walks the wire-supplied option array and, for every entry whose name matches CREDS VALUE, calls gssx dec linux creds on the same struct svc cred. That helper...

PT-2026-96479

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-96331

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss krb5 unwrap v2 sets buf-len to a logical length, which can be much smaller than head0.iov len the allocated receive-page capacity. It then calls xdr buf trim with a...

PT-2026-96600

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss unwrap resp priv length checks gss unwrap resp priv validates the RPCSEC GSS opaque length with offset = u8 p - u8 head-iov base; if offset + opaque len rcv buf-len goto unwrap failed; maj stat = gss unwrapctx-...

PT-2026-96402

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpc clnt handle event and rpc clnt remove pipedir Normal client creation goes through rpc setup pipedir, which records clnt-pipefs sb, but the mount-event path in rpc clnt handle event calls rpc setu...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053242 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssxdecoptionarray The creds and oa-data need to be freed in the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053407)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053407 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...