413643 matches found
CVE-2026-89540 sunrpc: init gssp_lock before publishing proc entry
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...
EUVD-2026-76451
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...
CVE-2026-89540
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...
CVE-2026-89540
A race condition in the Linux kernel's sunrpc component allows a local attacker to trigger concurrent access to set_gssp_clnt(). The root cause is that create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before the gssp_lock mutex is initialized, creatin...
EUVD-2026-76450
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...
CVE-2026-89539 SUNRPC: reject duplicate CREDS_VALUE options
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...
CVE-2026-89539 SUNRPC: reject duplicate CREDS_VALUE options
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...
CVE-2026-89539
Linux kernel SUNRPC subsystem: gssx_dec_option_array() processes wire-supplied GSS option entries and calls gssx_dec_linux_creds() for each CREDS_VALUE match. Because that helper unconditionally overwrites creds->cr_group_info without releasing the previous pointer, a reply containing two CRED...
CVE-2026-89539
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...
CVE-2026-89535 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...
CVE-2026-89535 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...
EUVD-2026-76441
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...
CVE-2026-89535
CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma module, caused by an incorrect ordering of operations during RDMA transport teardown. Specifically, rpcrdma_rn_unregister() was called after rdma_destroy_id(), leaving the transport's notification entry installed in th...
CVE-2026-89535
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...
EUVD-2026-76440
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...
CVE-2026-89534 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...
CVE-2026-89534
CVE-2026-89534 is a use-after-free in the Linux kernel's svcrdma module. When svc_rdma_listen_handler() processes an RDMA_CM_EVENT_ADDR_CHANGE event, it allocates a replacement listener cm_id and instructs the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still ref...
CVE-2026-89534
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...
CVE-2026-89534 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...
EUVD-2026-76434
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...