EUVD-2026-76582

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89670

CVE-2026-89670 is a use-after-free in the Linux kernel's NFSd (kernel NFS server) local I/O path. In nfsd_open_local_fh(), the again: retry block performs a cmpxchg load followed by nfsd_file_get() without holding rcu_read_lock. The sole caller drops the RCU read lock before invoking this helper,...