EUVD-2026-76613

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89694

CVE-2026-89694 affects the Linux kernel NFS server (nfsd) on the OFFLOAD_CANCEL path. The function manage_cpntf_state() freed a target copy-notify state without verifying ownership. Because the lookup key (st->si_opaque.so_id) is allocated cyclically (guessable) and the embedded clientid is a ...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

EUVD-2026-76606

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89693 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

CVE-2026-89687

CVE-2026-89687 affects the nfsd (Network File System Daemon) subsystem of the Linux kernel . The root cause is that the ->atomic_open operation is permitted to return success without actually opening the file (via finish_no_open()), which means dentry_create() can return a file that has not be...

EUVD-2026-76584

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632

CVE-2026-89632 is an out-of-bounds read in the Linux kernel's SMB client , specifically in the reparse_buf_ptr() function. The root cause is a use-before-check of ReparseDataLength (offset 4, 2 bytes): the value is read before verifying that the received buffer length (count) is at least the full...

EUVD-2026-76544

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630

CVE-2026-89630 is a critical vulnerability in the Linux kernel's CIFS/SMB client . A regression introduced by commit 83bfbd0bb902 (which removed the RFC1002 header from smb_hdr) caused the data_offset bound check in is_valid_oplock_break() to evaluate to zero, effectively disabling the overflow g...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...