Linux Distros Unpatched Vulnerability : CVE-2026-89688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a...

DEBIAN-CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89688

CVE-2026-89688 affects the Linux kernel's nfsd (NFS server) component. In nfs4_preprocess_seqid_op(), when nfsd4_cstate_assign_replay() returns -EAGAIN (replay owner being torn down), the error path incorrectly drops a stateowner reference it never acquired while leaking the stid reference it did...

CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

PT-2026-90404

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid op replay retry In nfs4 preprocess seqid op the stateid is obtained from nfsd4 lookup stateid, which holds a reference on the nfs4 stid sc count but takes no reference on the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053251)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053251 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: reset dst in route object after setting up flow dst is transferred to...

Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-085343)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-085343 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svcxprtput on rpccreate failure On error situation...

CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

EUVD-2026-67559

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098928)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098928 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099000)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099000 advisory. In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098949)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098949 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: mpt3sas: Fixed the use-after-free warning. Fixed the following use-after-free warnings that were observed during controller reset: refcountt: Underflow; use-after-free. WARNING: CPU: 23; PID: 5399; Location:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/vc4: Do not check if plane-state-fb == state-fb Currently, when using non-blocking commits, the following kernel warnings can be observed: 110.908514 ------------ Cut here ------------ 110.908529 refcountt: Underflow; Use...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: resetting dst in the route object after setting up a flow. The dst field is now transferred to the flow object, and the route object no longer owns it. Resetting dst in the route object is necessary;...