CVE-2026-89719 zram: fix out-of-bounds access in read_block_state()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

CVE-2026-89719

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

EUVD-2026-76630

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

CVE-2026-89718 zram: fix out-of-bounds access in writeback_store()

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

CVE-2026-89718

CVE-2026-89718 is an out-of-bounds access in the Linux kernel's zram module , specifically in the writeback_store() function. The root cause is a race condition: scan bounds are derived from zram->disksize before acquiring dev_lock. If the zram device is reset and reinitialized with a smaller ...

CVE-2026-89718

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

EUVD-2026-76627

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89715

CVE-2026-89715 is a reference leak in the Linux kernel NFS/localio subsystem. When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing the RCU pointer. The error path in nfs_open_local_fh() then leaks a caller-owned nfsd_file reference (pi...

CVE-2026-89715 NFS/localio: fix ref leak on nfs_uuid_add_file failure

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

EUVD-2026-76624

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89705 nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89704

CVE-2026-89704 affects the nfsd (NFS server) component of the Linux kernel . The root cause is that _nfsd_copy_file_range() samples the writeback error cursor (dst->f_wb_err) after the copy loop rather than before it. Because the nfsd_file cache reuses a single struct file across requests on t...

EUVD-2026-76616

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89704 nfsd: sample writeback error cursor before async COPY loop

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

EUVD-2026-76598

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...