CVE-2026-89709 lockd, nfsd: RCU-protect nlmsvc_ops dispatch

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89709 lockd, nfsd: RCU-protect nlmsvc_ops dispatch

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89708

CVE-2026-89708 is a use-after-free race condition in the Linux kernel's NFS daemon (nfsd) . During NFSv4 session teardown (DESTROY_SESSION), the session memory can be freed via kfree() while an in-flight callback rpc_task on rpciod still dereferences clp->cl_cb_session. The workqueue flush in ...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

EUVD-2026-76602

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690

CVE-2026-89690 is a use-after-free in the nfsd (NFS server daemon) component of the Linux kernel. The rpc_status netlink dumpit reads operation numbers from args->ops[] under rcu_read_lock, but that vmalloc buffer is freed synchronously via vfree() in nfsd4_release_compoundargs() without being...

CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

EUVD-2026-76582

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670

CVE-2026-89670 is a use-after-free race condition in the Linux kernel's nfsd (NFS daemon) component. In nfsd_open_local_fh(), a retry path loads a pointer via cmpxchg and calls nfsd_file_get() without holding rcu_read_lock, while the nfsd_file slab is created without SLAB_TYPESAFE_BY_RCU. Once th...

CVE-2026-89567 jbd2: bound shrinker scans by examined checkpoint buffers

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...

CVE-2026-89567

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...

EUVD-2026-76478

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...

CVE-2026-89567

CVE-2026-89567 affects the jbd2 (Journalling Block Device v2) subsystem of the Linux kernel . The root cause is that the jbd2 shrinker accounts only successfully released checkpoint buffers against its scan budget (nr_to_scan ), meaning busy buffers consume no budget. If a checkpoint transaction ...

CVE-2026-89566 jbd2: check need_resched() when skipping busy checkpoint buffers

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...

EUVD-2026-76477

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...

CVE-2026-89566

In the Linux kernel, the following vulnerability has been resolved: jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The continue statement on this path also skips the needresched check at the e...