CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server nfsd. An authenticated NFSv4.2 client could exploit a vulnerability in the managecpntfstate function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leadi...

AZL-100175 CVE-2026-89694 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...