UBUNTU-CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

UBUNTU-CVE-2026-72472

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flclock while iterating over the file lock list to...

UBUNTU-CVE-2026-72467

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72217

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

UBUNTU-CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

UBUNTU-CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72472

CVE-2026-72472 – Linux kernel NFS file lock traversal protection fix . The issue arises in the NFS portion of the Linux kernel where releasing flc_lock during file lock list traversal could trigger use-after-free (UAF). The mitigation switches to protecting the traversal with nfsi->rwsem, appl...

CVE-2026-72472 nfs: use nfsi->rwsem to protect traversal of the file lock list

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flclock while iterating over the file lock list to...

CVE-2026-72472 nfs: use nfsi->rwsem to protect traversal of the file lock list

In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi-rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flclock while iterating over the file lock list to...

CVE-2026-72468

Summary: CVE-2026-72468 affects the Linux kernel components xprtrdma/rpcrdma. A race between NFS/RDMA mount and RDMA device removal could trigger a NULL dereference in the kernel trace path. Affected context (from provided docs): rpcrdma_ep_create() and rpcrdma_create_id() interactions allow the ...

CVE-2026-72468 xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72468 xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

EUVD-2026-59367

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72467

CVE-2026-72467 (Linux kernel, xprtrdma) : The vulnerability arises when frwr_wp_create() fails during connect and rpcrdma_xprt_connect() ignores the error, causing xprt_rdma_connect_worker() to incorrectly report success and set XPRT_CONNECTED. A subsequent NFS/RDMA read with a non‑4‑byte‑aligned...

CVE-2026-72467 xprtrdma: Check frwr_wp_create() during connect

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...

EUVD-2026-59366

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...