CVE-2026-89694

CVE-2026-89694 affects the Linux kernel NFS server (nfsd) on the OFFLOAD_CANCEL path. The function manage_cpntf_state() freed a target copy-notify state without verifying ownership. Because the lookup key (st->si_opaque.so_id) is allocated cyclically (guessable) and the embedded clientid is a ...

CVE-2026-89669

This Linux kernel vulnerability affects the nfsd (NFS server) component. A race condition in nfsd4_copy_notify() allowed the copy-notify (cpntf) state to be published into the s2s_cp_stateids IDR and the parent's sc_cp_list before cp_p_stateid and cp_p_clid were fully initialized. A racing OFFLOA...

CVE-2026-89663

CVE-2026-89663 is a use-after-free vulnerability in the Linux kernel's NFS server (nfsd) subsystem, specifically in the management of copy-notify stateids . The root cause is a reference-counting race: all three revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fixed reference count leaks in nfs42proccopynotify. You don’t often receive emails from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue...

The vulnerability of the _nfs42 ProcCopyNotify() function in the fs/nfs/nfs42proc.c module, which is part of the NFS client support in Linux kernel, allows a attacker to cause a service failure.

The vulnerability of the nfs42 ProcCopyNotify function in the fs/nfs/nfs42proc.c module, which is part of the NFS client support in Linux kernel, is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

EUVD-2025-201582

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4freeolstateid Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4laundromat if the stateid hasn't been used in a lease period. However, in case...

DEBIAN-CVE-2025-40273

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4freeolstateid Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4laundromat if the stateid hasn't been used in a lease period. However, in case...

SUSE CVE-2022-49103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix reference count leaks in nfs42proccopynotify You don't often get email from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue happens in...

UBUNTU-CVE-2022-49103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix reference count leaks in nfs42proccopynotify You don't often get email from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue happens in...