CVE-2026-89706

A flaw was found in the Linux kernel's nfsd component. When an asynchronous async copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made durable, resulting in the silent loss of data that was intend...

CVE-2026-89676

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

CVE-2026-89675

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89676

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

EUVD-2026-76618

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89706 nfsd: Reset write verifier when async COPY writeback fails

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89706

In the Linux kernel NFS server (nfsd) , the write verifier (nn->writeverf) is not rotated when an async COPY operation's post-copy writeback fails. As a result, a client that receives NFS_UNSTABLE via CB_OFFLOAD and subsequently issues COMMIT receives the same verifier value , leading the clie...

CVE-2026-89704

In the Linux kernel nfsd subsystem, _nfsd_copy_file_range() samples the writeback error cursor (dst->f_wb_err) after the async copy loop rather than before it. Because the nfsd_file cache reuses a single struct file across concurrent requests on the same inode, a concurrent COMMIT or stable WR...

CVE-2026-89676 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

EUVD-2026-76588

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

CVE-2026-89676

CVE-2026-89676 affects the Linux kernel nfsd (NFS server) component. During an asynchronous COPY operation, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), causing the s2s_cp_stateids IDR to reference a transient per-request COMPOUND buffer rather than the stable async_copy s...

EUVD-2026-76587

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89675

CVE-2026-89675 is a use-after-free (UAF) in the Linux kernel's NFS daemon (nfsd) , occurring when a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, or nfsd4_cancel_copy_by_sb) races the async copy kthread. The root cause involves multiple lifetime-management defects: concurrent release of n...

CVE-2026-89675 nfsd: fix UAF in async copy cancel and shutdown

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

PT-2026-90391

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOAD CANCEL, nfsd4 shutdown copy, nfsd4 cancel copy by sb raced the copy kthread: - find async copy bumped...

PT-2026-90422

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CB OFFLOAD after the worker kthread completes. When the post-copy vfs fsync range or...

PT-2026-90392

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s cp stateids IDR entry for async COPY For an async COPY, nfsd4 copy called nfs4 init copy state before dup copy fields, so the s2s cp stateids IDR was pointed at &u-copy-cp stateid -- memory in the per-rqstp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Cleanup of potential nfsdfile refcount leaks in the COPY code path. There are two different versions of the nfsd4copy structure. One is embedded within the compound structure and is used directly in synchronous copies. T...