CVE-2026-90039

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities could trigger a null pointer dereference by attempting to unlock a filesystem or export via specific netlink commands before the NFSD internal tables are fully initialized...

CVE-2026-93211

A flaw was found in the nfsd component of the Linux kernel. Due to an incorrect initialization order of the Dynamic Resource Cache DRC hash table, a system crash Denial of Service can occur on weakly-ordered architectures like ARM64 and PowerPC. This happens when a shrinker scan attempts to acces...

RHEL 9 : kernel (RHSA-2026:77689)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77689 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be...

CVE-2026-93229

A flaw was found in the Linux kernel's Network File System daemon nfsd. A local user can cause a Denial of Service DoS or observe inconsistent kernel data on systems with weakly-ordered processor architectures. This issue occurs due to a missing read memory barrier in the Remote Procedure Call RP...

CVE-2026-93212

A flaw was found in the Linux kernel NFS daemon nfsd. During network teardown, the nfsdserv pointer is prematurely cleared while the file cache cleanup process is still active. This can lead to a null pointer dereference in the nfsdfilenetdispose function. Exploiting this vulnerability could caus...

Oracle Linux 10 : kernel (ELSA-2026-77690)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-77690 advisory. - udp: fix potential use-after-free in tunnel segmentation Antoine Tenart RHEL-268127 CVE-2026-74705 - nfsd: defer vfree of compound ops to fix...

Oracle Linux 9 : kernel (ELSA-2026-83156)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83156 advisory. - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Jan Polensky RHEL-271472 CVE-2026-80985 - net/smc: bound the peer rkey counts in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: The issue in nfsd4setclientidconfirm where the function does not check the return value from getclientlocked was addressed. In this case, a SETCLIENTIDCONFIRM operation might race with a confirmed client’s expiration, causi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: Check the client ownership when canceling a copy-notify stateid. On the OFFLOADCANCEL path clp != NULL, the managecpntfstate function freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: The stateids used for copy-notify were revoked before their references were dropped. Stateids used for copy-notify are stored in the s2scpstateids IDR and on their parent stid’s sccplist, and are pinned by a single membersh...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: resetting the write verifier for deferred writeback errors Both nfsdvfswrite and nfsdcommit call filemapcheckwberr to detect deferred writeback errors. However, neither rotates the server’s write verifier nn-writeverf wh...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold a reference to the net structure for the lifetime of the open file descriptor. The /proc/fs/nfs/exports proc entry is created during module initialization and remains valid throughout the lifetime of the module. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: The free copynotify stateid in nfs4freeolstateid has been fixed. Typically, the copynotify stateid is freed either when the parent’s stateid is being closed/freed, or in nfsd4laundromat if the stateid has not been used duri...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: fixed a race condition between nfsd registration and exportsproc Currently, nfsd calls createprocexportsentry at the beginning of initnfsd, and cleanup is performed by removeprocentry at the end of exitnfsd. This can lea...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: A sample writeback error occurred when the COPY loop executed asynchronously. The function nfdscopyfilerange records the value dst-fwberr after the copy operation, and then uses this value to detect writeback errors via...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSD: Restarting the sscexpireumount walk after dropping the nfsdssclock The nfsd4sscexpireumount function iterates over the nn-nfsdsscmountlist using listforeachentrysafeni, tmp, .... For each expired entry, it sets nsuibusy =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: Prevent lock owners from being used after free during client teardown destroyclient releases a client’s open owners. However, a lock owner whose only reference is a blocked lock nbl remains on clownerstrhashtbl...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the XDR length calculation in nfsd4ffencodelayoutget. The XDR buffer size calculation in nfsd4ffencodelayoutget contains multiple errors that can lead to either an out-of-bounds write or the leakage of uninitialize...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the race condition in cpntf publish in nfs4initcpstate. In nfs4allocinitcpntfstate, the new cpntf entry was published into the s2scpstateids IDR with cstype set, and then the lock was taken again to append it to...