EUVD-2026-76594

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89682

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89682 nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89667

CVE-2026-89667 is a race condition in the Linux kernel's nfsd file cache subsystem. When the shrinker, GC worker, or fsnotify/lease callbacks unhash an nfsd_file and queue it for delayed disposal concurrently with nfsd_file_cache_shutdown_net(), the shutdown path can miss the file and drain the d...

CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

EUVD-2026-76579

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89667

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89527 svcrdma: Use svc_xprt_put to free listener on create failure

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527

This Linux kernel vulnerability affects the svcrdma (RPC/NFS RDMA server) subsystem. The root cause is an improper error-path cleanup in svc_rdma_create(): when svc_rdma_create_listen_id() fails, the code calls kfree() on the transport structure, bypassing svc_xprt_free(). This leaks the net name...

CVE-2026-81003 net/iucv: filter frames in afiucv_hs_rcv() by ingress device

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-80997 net: ipa: fix stalled modem TX queue after runtime resume

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80990 net: thunderbolt: Release the Rx HopID that was handed out on mismatch

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

CVE-2026-80990

CVE-2026-80990 is a resource-leak bug in the Linux kernel Thunderbolt networking (tbnet ) subsystem. In tbnet_connected_work(), the function requests a specific Rx HopID from tb_xdomain_alloc_in_hopid(), which uses ida_alloc_range() with the desired ID as a lower bound. If the requested ID is alr...

CVE-2026-80985 net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80986 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

EUVD-2026-76308

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80982

CVE-2026-80982 is a use-after-free in the Linux kernel's SMC (Shared Memory Communications) network protocol (net/smc). The root cause is a race condition in smc_rx_pipe_buf_release(): it checks sk_state before acquiring the socket lock, so a concurrent smc_conn_free() can release the connection ...

CVE-2026-80981 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...