CVE-2026-89672

CVE-2026-89672 affects the Linux kernel's NFS server daemon (nfsd) in the NFSACL v2 SETACL path. The function nfsacld_proc_setacl() passes both argp->acl_access and argp->acl_default pointers to set_posix_acl() unconditionally, even when the request mask does not include the corresponding b...

EUVD-2026-76583

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

CVE-2026-89671 nfsd: gate nfs3 setacl by argp->mask

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

CVE-2026-89671 nfsd: gate nfs3 setacl by argp->mask

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

CVE-2026-89671

CVE-2026-89671 affects the Linux kernel's NFSv3 server daemon (nfsd). The function nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing decoded pointers verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding...

CVE-2026-89671

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

EUVD-2026-76582

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

EUVD-2026-76581

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89669

CVE-2026-89669 is a use-after-free in the Linux kernel's nfsd (NFS server) component. The copy-notify state ID was published into the s2s_cp_stateids IDR before its cp_p_stateid/cp_p_clid fields were fully initialized. A racing OFFLOAD_CANCEL with a crafted client ID and guessable sequence number...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89669 nfsd: initialize copy-notify stateid before publishing it

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89670

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89669 nfsd: initialize copy-notify stateid before publishing it

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89670

CVE-2026-89670 is a use-after-free race condition in the Linux kernel's nfsd (NFS daemon) component. In nfsd_open_local_fh(), a retry path loads a pointer via cmpxchg and calls nfsd_file_get() without holding rcu_read_lock, while the nfsd_file slab is created without SLAB_TYPESAFE_BY_RCU. Once th...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668

CVE-2026-89668 affects the nfsd (NFS daemon) component of the Linux kernel . In init_nfsd(), nfsd_debugfs_init() is called before nfsd4_init_slabs(). If the slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphaned debugfs files with stale fops pointers into freed mod...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...