396122 matches found
CVE-2026-89720
CVE-2026-89720 is an out-of-bounds read in the Linux kernel's UBIFS filesystem. The root cause is a sign error in ubifs_sb_verify_signature(): the bounds check adds the 64-byte ubifs_sig_node header size instead of subtracting it, allowing a crafted ubifs_sig_node->len value up to 128 bytes la...
CVE-2026-89719
CVE-2026-89719 affects the zram subsystem of the Linux kernel . The vulnerability is an out-of-bounds access in read_block_state() caused by a race condition: nr_pages is calculated before acquiring dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition...
CVE-2026-89718
CVE-2026-89718 is an out-of-bounds access in the Linux kernel's zram module , specifically in the writeback_store() function. The root cause is a race condition: scan bounds are derived from zram->disksize before acquiring dev_lock. If the zram device is reset and reinitialized with a smaller ...
CVE-2026-89717
This vulnerability affects the Linux kernel's zram module. In zram_destroy_comps(), all compressors are reset to NULL , including the primary compressor , leaving the device in an invalid state. This can lead to a NULL pointer dereference when comp_algorithm_show() calls strcmp() on the NULL prim...
CVE-2026-89715
CVE-2026-89715 is a reference leak in the Linux kernel NFS/localio subsystem. When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing the RCU pointer. The error path in nfs_open_local_fh() then leaks a caller-owned nfsd_file reference (pi...
CVE-2026-89716
CVE-2026-89716 affects the Linux kernel's zram module. User-supplied deflate winbits are passed to zlib_deflate_workspacesize() without validation; if the value falls outside the valid range, a BUG_ON() is triggered, resulting in a kernel bug/panic. The fix validates the winbits parameter before ...
CVE-2026-89714
This Linux kernel vulnerability affects the NFSv4 client subsystem. The root cause is a memory leak of server->delegation_hash_table (4 KiB per attempt with the default delegation watermark) when nfs4_server_common_setup() fails at an intermediate step (is_ds_only_client(), nfs4_init_session()...
CVE-2026-89713
CVE-2026-89713 is a TOCTOU vulnerability in the Linux kernel's NFSD component. The function nfsd_setattr() checks whether a size update requires NFSD_MAY_TRUNC permission using an unlocked file size sample, but the actual ATTR_SIZE update via notify_change() is applied later under inode_lock(). A...
CVE-2026-89712
This Linux kernel NFSD vulnerability is a use-after-free in nfsd4_ssc_expire_umount(). When the function drops nfsd_ssc_lock to call mntput() on a source vfsmount, a concurrent nfsd4_ssc_cancel_dul() thread can free the saved tmp pointer that the list_for_each_entry_safe macro relies on to contin...
CVE-2026-89711
CVE-2026-89711 affects the Linux kernel's NFSD (NFS Daemon) subsystem. A flawed WARN_ON_ONCE in nfsd_mode_check() was added based on an invalid assumption that i_op->lookup is always present. When NFSD exports an NFS filesystem (NFS reexport), it is possible to encounter a dentry lacking i_op-...
CVE-2026-89710
CVE-2026-89710 is a layout segment leak in the Linux kernel's NFSv4.1/pNFS subsystem. When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() jumps to out_forget without draining the on-stack free_me list; only the success path calls pnfs_free_lseg_list...
CVE-2026-89709
In the Linux kernel , the lockd and nfsd subsystems contain a race condition in the dispatch of the nlmsvc_ops pointer. The pointer is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() using plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcs...
CVE-2026-89708
CVE-2026-89708 is a use-after-free in the Linux kernel's nfsd (NFS server) component, triggered during NFSv4 session teardown. After a DESTROY_SESSION , the session object can be freed via kfree() while rpciod still holds an in-flight callback rpc_task that dereferences clp->cl_cb_session. A s...
CVE-2026-89707
CVE-2026-89707 affects the Linux kernel nfsd subsystem, specifically the nfsd_cross_mnt() function. The root cause is a missing path_put() call in the error path when follow_down() returns a negative value, leaving the mntget()/dget() references acquired on entry unreleased. The impact is a memor...
CVE-2026-89706
In the Linux kernel NFS server (nfsd) , the write verifier (nn->writeverf) is not rotated when an async COPY operation's post-copy writeback fails. As a result, a client that receives NFS_UNSTABLE via CB_OFFLOAD and subsequently issues COMMIT receives the same verifier value , leading the clie...
CVE-2026-89705
CVE-2026-89705 is a lockless reader out-of-bounds read in the Linux kernel's nfsd component. The nfsd_dispatch() function uses rq_status_counter as a seq-lock protocol: it sets the counter to an odd value after decoding a request and back to even after full processing. However, the cache-hit (RC_...
CVE-2026-89704
In the Linux kernel nfsd subsystem, _nfsd_copy_file_range() samples the writeback error cursor (dst->f_wb_err) after the async copy loop rather than before it. Because the nfsd_file cache reuses a single struct file across concurrent requests on the same inode, a concurrent COMMIT or stable WR...
CVE-2026-89703
CVE-2026-89703 is a use-after-free vulnerability in the Linux kernel's NFS daemon (nfsd) . The function nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but fails to set the SC_STATUS_FREED flag before releasing cl_lock. As a result, revoke_delegation() cannot detect t...
CVE-2026-89702
CVE-2026-89702 is a Linux kernel vulnerability in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. These tracepoints declare the server sockaddr slot sized by xpt_remotelen but populate it using xpt_locallen . When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past t...