CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

AZL-100871 CVE-2026-89663 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89496

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

AZL-100295 CVE-2026-89496 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

DEBIAN-CVE-2026-89496

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

DEBIAN-CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

AZL-100196 CVE-2026-81002 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

UBUNTU-CVE-2026-89680

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

CVE-2026-89680

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

UBUNTU-CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89496

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copyfilerange' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: comm...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

UBUNTU-CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

UBUNTU-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...