CVE-2026-89713

A TOCTOU race condition in the Linux kernel's NFS Daemon (NFSD) component allows a remote, unauthenticated attacker to bypass append-only file protections. In nfsd_setattr(), the NFSD_MAY_TRUNC permission check samples the file size without holding inode_lock(), but the actual size update is appl...

EUVD-2026-76625

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

EUVD-2026-76624

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89705

CVE-2026-89705 affects the Linux kernel NFS daemon (nfsd) . The nfsd_dispatch() function uses a sequence-lock-like protocol via rq_status_counter, setting it to an odd value when a request is decoded and restoring it to even after processing. However, the cache-hit, drop, and encode-error exit pa...

EUVD-2026-76617

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89686

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662

CVE-2026-89662 is a use-after-free vulnerability in the Linux kernel's NFSD (Network File System Daemon) component, triggered during client teardown. A race condition between __destroy_client() and the per-net laundromat (which independently reaps blocked locks) allows a lock owner to be freed wh...

EUVD-2026-76574

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89660

CVE-2026-89660 is a use-after-free in the Linux kernel's NFSD (Network File System Daemon) subsystem, rated CVSS 9.8 (Critical) . The flaw arises in nfsd4_revoke_states(), which drops client_lock while dereferencing a client to revoke a stateid. A concurrent teardown can free the nfs4_client befo...

CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89609 ecryptfs: hold msg ctx list lock when cleaning daemon queue

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

CVE-2026-89609

CVE-2026-89609 is a race condition in the eCryptfs component of the Linux kernel. The function ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding the ecryptfs_msg_ctx_lists_mux lock, which ecryptfs_msg_ctx_alloc_to_free() requires. This allows concurrent access t...