CVE-2026-89713

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A remote attacker, by sending a crafted file attribute modification request SETATTR while a file is being concurrently appended, could exploit a time-of-check to time-of-use TOCTOU vulnerability. This could lead to the...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

UBUNTU-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

DEBIAN-CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

AZL-100142 CVE-2026-89713 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89640

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

DEBIAN-CVE-2026-89640

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

AZL-100292 CVE-2026-89640 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

CVE-2026-89640

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

UBUNTU-CVE-2026-89640

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

UBUNTU-CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89713

A TOCTOU race condition in the Linux kernel's NFS Daemon (NFSD) component allows a remote, unauthenticated attacker to bypass append-only file protections. In nfsd_setattr(), the NFSD_MAY_TRUNC permission check samples the file size without holding inode_lock(), but the actual size update is appl...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

EUVD-2026-76625

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...