CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fixed the issue where the connection was used after freeing it during resets. If we do not perform a unbindtarget call, we can encounter a race condition where iscsiconnteardown wakes up the EH thread, and then frees...

Linux Distros Unpatched Vulnerability : CVE-2026-89708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per- session teardown path can free a session while rpciod...

Linux Distros Unpatched Vulnerability : CVE-2026-89569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding...

Linux Distros Unpatched Vulnerability : CVE-2026-80926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which ma...

AZL-100118 CVE-2026-89708 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

DEBIAN-CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

DEBIAN-CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

UBUNTU-CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

UBUNTU-CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

UBUNTU-CVE-2026-89641

In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfoput in cifsfilesetsize When the else branch of cifsfilesetsize finds a writable file handle via findwritablefile, it borrows tcon and server from the handle's tlink, attempts the handle-based...

EUVD-2026-76620

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89708

CVE-2026-89708 is a use-after-free race condition in the Linux kernel's NFS daemon (nfsd) . During NFSv4 session teardown (DESTROY_SESSION), the session memory can be freed via kfree() while an in-flight callback rpc_task on rpciod still dereferences clp->cl_cb_session. The workqueue flush in ...

CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

CVE-2026-89569 Bluetooth: RFCOMM: serialize security confirmation handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

EUVD-2026-76480

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...