PT-2026-90259

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpc clnt handle event and rpc clnt remove pipedir Normal client creation goes through rpc setup pipedir, which records clnt-pipefs sb, but the mount-event path in rpc clnt handle event calls rpc setu...

PT-2026-90264

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache cleaner before destroying a cache detail sunrpc destroy cache detail only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty...

PT-2026-90265

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc pool for cpu svc set num threads spreads the requested threads evenly across the service's pools base = nrservs / sv nrpools. When a service runs fewer threads than it has pools -- e.g. an...

PT-2026-90257

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss unwrap resp priv length checks gss unwrap resp priv validates the RPCSEC GSS opaque length with offset = u8 p - u8 head-iov base; if offset + opaque len rcv buf-len goto unwrap failed; maj stat = gss unwrapctx-...

PT-2026-90261

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq argp and rq resp free until after RCU grace period svc rqst free frees rqstp-rq argp and rqstp-rq resp synchronously via kfree, but defers the rqstp struct free via kfree rcu. After svc exit thread calls list del...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053242 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssxdecoptionarray The creds and oa-data need to be freed in the...

The vulnerability of the rpcrdma_post_recvs() function in the net/sunrpc/xprtrdma/verbs.c module of the Linux operating system’s RPC protocol implementation allows a attacker to cause a service failure.

The vulnerability of the rpcrdmapostrecvs function in the net/sunrpc/xprtrdma/verbs.c module of the Linux operating system’s RPC protocol implementation is related to incorrect resource initialization. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcpwritetimerhandler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows This fix prevents svcrdmabuildwrites from exceeding the end of a Write chunk’s segment array. This issue was identified using KASAN. The test that this fix replaces is invalid; it may have...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: Avoid NULL dereferencing on a zero-length gsstoken in gssreadproxyverf A zero-length gsstoken results in pageaddress being == 0, and intoken-pages0 being NULL. The code pageaddressintoken-pages0, which can lea...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed null-ptr-deref when xps sysfs alloc fails There is a null-ptr-deref when xps sysfs alloc fails: BUG: KASAN: null-ptr-deref in sysfsdocreatelinksd+0x40/0xd0 Reading a 8-byte value at address 0000000000000030 by ta...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sunrpc: When canceling a TLS handshake that is still in progress, there is a race condition where the callback for the ongoing handshake is not properly handled. When waitforcompletioninterruptibletimeout in svctcphandshake retur...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed a suspicious RCU usage warning I received the following warning while running cthon on an Ontap server running pNFS: 57.202521 ============================= 57.202522 WARNING: Suspicious RCU usage 57.202523...

Astra Linux – Vulnerability in glibc

The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library also known as glibc from versions up to 2.34 copies its hostname argument onto the stack without validating its length. This may lead to a buffer overflow, potentially causing a denial of service or, if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed the loop termination condition in gssfreeintokenpages. The intoken-pages array is not NULL-terminated. This results in the following KASAN issue: KASAN: Potential wild-memory-access in the range...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fixed the svcdeferredevent trace class. Fixed a NULL dereference crash that occurs when an svcrqst is deferred, while the sunrpc tracing subsystem is enabled. svcrevisit sets dr-xprt to NULL, so it cannot be relied upon i...

SUSE CVE-2026-72317

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

SUSE CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

SUSE CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72317

A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...