CVE-2026-89702 nfsd: size fh_verify server sockaddr slot by xpt_locallen

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89693

CVE-2026-89693 affects the Linux kernel's NFS daemon (nfsd) . The vulnerability is in the nfsd4_create() function, where the return value of nfsd4_acl_to_attr() is stored in status but unconditionally overwritten by every branch of the switch(create->cr_type) block. As a result, ACL translatio...

CVE-2026-89692

This vulnerability affects the Linux kernel NFS server (nfsd ) component, specifically the delegation recall mechanism. When nfsd_break_one_deleg() fails to queue a recall via nfsd4_run_cb(), the NFSD4_CALLBACK_RUNNING bit is left permanently set because the only code path that clears it (nfsd41_...

EUVD-2026-76604

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89689

This vulnerability affects the Linux kernel nfsd (NFS daemon) subsystem. The root cause is a use-after-free in nfsd4_sequence(): when the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs, the free_session_slots() function can free the very slot the current request is processi...

EUVD-2026-76600

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89689 nfsd: don't free session slots that are still in use

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...

EUVD-2026-76601

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...

CVE-2026-89685

CVE-2026-89685 affects the nfsd subsystem in the Linux kernel . The function clients_still_reclaiming() computes a grace-period deadline from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since boot). Because ...

CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

EUVD-2026-76597

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

CVE-2026-89685 nfsd: fix clock domain mismatch in clients_still_reclaiming()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

CVE-2026-89684

CVE-2026-89684 is a race condition in the Linux kernel's NFS server (nfsd) copy-notification state management. The function nfs4_alloc_init_cpntf_state() published a new cpntf entry into the s2s_cp_stateids IDR in one lock section, then acquired the lock again to add it to the parent's sc_cp_list...

CVE-2026-89683 nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

CVE-2026-89680

CVE-2026-89680 is a resource leak in the Linux kernel's NFS server daemon (nfsd) . When the inter-server COPY setup function nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the cleanup path (out: label) where release_copy_files() would release the nf_...

CVE-2026-89680

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

EUVD-2026-76590

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89677

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

CVE-2026-89677 nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...