EUVD-2026-78122

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory...

CVE-2026-43686

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory...

EUVD-2026-77942

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may disclose kernel memory...

CVE-2026-43687

CVE-2026-43687 is a memory-handling flaw in Apple's NFS client that allows kernel memory disclosure when a user connects to a malicious NFS server. The issue was addressed with improved memory handling and is fixed in iOS 26.7 , iPadOS 26.7 , iOS 27 , iPadOS 27 , macOS Golden Gate 27 , macOS Taho...

CVE-2026-84544

CVE-2026-84544 is an integer overflow in the macOS NFS client addressed with improved input validation. The vulnerability affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 . Connecting to a malicious NFS server may cause unexpected system termination or kernel memory corrupti...

EUVD-2026-77872

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory...

CVE-2022-22029-NFS-Server-

Windows 网络文件系统远程代码执行漏洞 CVE-2022-22039 要成功利用此漏洞，攻击者必须在一个竞争条件中获胜。向网络文件系统 NFS 服务发出未经身份验证的精心构造的调用，可用于在网络上远程利用此漏洞。 缓解措施是指一种默认状态下存在的设置、通用配置或最佳实践，可降低漏洞利用的严重性。以下缓解因素可能对您的情况有所帮助： 此漏洞在 NFSV4.1 中无法利用。在更新受此漏洞保护的 Windows 版本之前，您可以通过禁用 NFSV3 来缓解攻击。这可能会对您的生态系统产生不利影响，应仅作为临时缓解措施使用。 以下 PowerShell 命令将禁用 NFSV3：...

Linux Distros Unpatched Vulnerability : CVE-2026-89680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: lab...

Linux Distros Unpatched Vulnerability : CVE-2026-89696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and...

Linux Distros Unpatched Vulnerability : CVE-2026-89537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7,...

Linux Distros Unpatched Vulnerability : CVE-2026-89688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a...

Linux Distros Unpatched Vulnerability : CVE-2026-89678

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short...

CVE-2026-89672

A flaw was found in the Linux kernel's Network File System NFS server daemon nfsd. When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List ACL or both access and default ACLs. This occurs because the setposixacl function ...

DEBIAN-CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

DEBIAN-CVE-2026-89702

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89693

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

AZL-100325 CVE-2026-89697 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

DEBIAN-CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89687

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsdfiledoacquire does not use a non-opened file -atomicopen is permitted to return success without actually opening the file. It indicates this by calling finishnoopen. This means dentrycreate can return a file whic...