CVE-2022-22029-NFS-Server-

Windows 网络文件系统远程代码执行漏洞 CVE-2022-22039 要成功利用此漏洞，攻击者必须在一个竞争条件中获胜。向网络文件系统 NFS 服务发出未经身份验证的精心构造的调用，可用于在网络上远程利用此漏洞。 缓解措施是指一种默认状态下存在的设置、通用配置或最佳实践，可降低漏洞利用的严重性。以下缓解因素可能对您的情况有所帮助： 此漏洞在 NFSV4.1 中无法利用。在更新受此漏洞保护的 Windows 版本之前，您可以通过禁用 NFSV3 来缓解攻击。这可能会对您的生态系统产生不利影响，应仅作为临时缓解措施使用。 以下 PowerShell 命令将禁用 NFSV3：...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevention of potential integer overflows If the tag length is greater than or equal to U32MAX – 3, the addition of “length + 4” can lead to an integer overflow. This issue can be addressed by breaking down the decoding...

CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72217

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

UBUNTU-CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

EUVD-2026-59121

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72222

The CVE-2026-72222 entry corresponds to a Linux kernel vulnerability in the sunrpc TLS handshake path. The issue arises from races where an in-flight async TLS handshake callback can write through a freed svc_sock, due to the embedding svc_sock being container_of() referenced after tls_handshake_...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72217

The CVE-2026-72217 issue concerns SUNRPC in the Linux kernel where xdr_buf_to_bvec() writes a bio_vec before validating the destination slot, allowing an out-of-bounds write when budget is exhausted. The rq_bvec array used by nfsd_vfs_write() is allocated to rq_maxpages with no slack, so an overf...

PT-2026-72410

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc xprt across the asynchronous TLS handshake callback svc tcp handshake stores the raw svc xprt pointer in tls handshake args.ta data and submits the request through tls server hello x509. The handshake core takes...

USN-8615-2 linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8615-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-28931

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. Connecting to a malicious NFS server may lead to kernel memory corruption...

UBUNTU-CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

NFSD: Fix SECINFO_NO_NAME decode error cleanup

...

SUSE CVE-2026-53394

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When findorallocopenstateowner encounters an unconfirmed owner, it calls releaseopenowner and sets oo = NULL. Control then falls through past the if oo guard -...