EUVD-2026-76580

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89667

CVE-2026-89667 is a race condition in the Linux kernel's nfsd file cache subsystem. When the shrinker, GC worker, or fsnotify/lease callbacks unhash an nfsd_file and queue it for delayed disposal concurrently with nfsd_file_cache_shutdown_net(), the shutdown path can miss the file and drain the d...

CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89667

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

EUVD-2026-76579

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

EUVD-2026-76578

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666

CVE-2026-89666 affects the Linux kernel's nfsd (NFS server daemon). A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD carrying an atime or mtime whose nseconds field is out of range —it decodes as a valid uint32 but is not a valid timespec64. Nothing in the setattr path clamps ...

CVE-2026-89665

CVE-2026-89665 affects the Linux kernel's nfsd (NFS server daemon) component. The NFSv2 svcxdr_decode_sattr() function converts wire useconds to nanoseconds via tmp2 * NSEC_PER_USEC. On ILP32 (32-bit) architectures, unsigned long is 32 bits, so an out-of-range value (e.g., 4294968) wraps to a see...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

EUVD-2026-76577

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89664

CVE-2026-89664 affects the Linux kernel NFS daemon (nfsd) and causes a memory leak of refcounted POSIX ACL objects. The leak occurs when malformed NFSv4 OPEN compound operations carrying valid POSIX ACL attributes trigger a short-circuit path in nfsd4_open_omfg() where nfsd4_open() is never invok...

CVE-2026-89664

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

EUVD-2026-76576

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...