CVE-2026-89703 nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SCSTATUSFREED in nfsd4droprevokedstid for delegations nfsd4droprevokedstid handles FREESTATEID for admin-revoked delegations but does not set SCSTATUSFREED before releasing cllock. revokedelegation uses this flag to...

CVE-2026-89702 nfsd: size fh_verify server sockaddr slot by xpt_locallen

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89701 nfsd: validate nseconds in TIME_DELEG decode paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89700 nfsd: validate sockaddr length per family in listener_set

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

CVE-2026-89695 nfsd: cap decoded POSIX ACL count to bound sort cost

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89692 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89693 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89689 nfsd: don't free session slots that are still in use

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...

CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

CVE-2026-89687 nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsdfiledoacquire does not use a non-opened file -atomicopen is permitted to return success without actually opening the file. It indicates this by calling finishnoopen. This means dentrycreate can return a file whic...

CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUGON in nfsd4alloclayoutstateid on racing delegation revoke nfsd4alloclayoutstateid reads fp-fidelegfile without holding filock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat...

CVE-2026-89685 nfsd: fix clock domain mismatch in clients_still_reclaiming()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clientsstillreclaiming clientsstillreclaiming computes a deadline from nn-boottime CLOCKREALTIME, 1.7 billion but compares it against ktimegetboottimeseconds CLOCKBOOTTIME, seconds since boot. T...

CVE-2026-89684 nfsd: fix cpntf publish race in nfs4_init_cp_state

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

CVE-2026-89683 nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

CVE-2026-89681 nfsd: fix layout fence worker double-reference race

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORKSTRUCTPENDING before the callback is invoked, so delayedworkpending in lmbreakertimedout can return false while the fence worker is already running...

CVE-2026-89682 nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89680 nfsd: fix nfsd_file leak on inter-server COPY setup failure

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles would drop the nfdst reference taken by...

CVE-2026-89679 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

CVE-2026-89678 nfsd: fix partial-write detection in nfsd_direct_write

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

CVE-2026-89677 nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fhcompose of wrong dentry in nfsd4createfile dentrycreate can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server...

CVE-2026-89676 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2scpstateids IDR entry for async COPY For an async COPY, nfsd4copy called nfs4initcopystate before dupcopyfields, so the s2scpstateids IDR was pointed at &u-copy-cpstateid -- memory in the per-rqstp COMPOUND buff...

CVE-2026-89675 nfsd: fix UAF in async copy cancel and shutdown

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller OFFLOADCANCEL, nfsd4shutdowncopy, nfsd4cancelcopybysb raced the copy kthread: - findasynccopy bumped...

CVE-2026-89674 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

CVE-2026-89673 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...

CVE-2026-89672 nfsd: gate nfs2 setacl by argp->mask

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

CVE-2026-89671 nfsd: gate nfs3 setacl by argp->mask

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

CVE-2026-89669 nfsd: initialize copy-notify stateid before publishing it

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsdfile from the rhashtable and then call nfsdfiledisposelistdelayed to move it to the...

CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

CVE-2026-89663 nfsd: revoke copy-notify stateids before dropping their reference

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

CVE-2026-89661 NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...

CVE-2026-89660 NFSD: Prevent client use-after-free during admin state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89659 NFSD: Prevent client use-after-free during delegation revoke

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

CVE-2026-89657 libceph: validate OSD extent maps before cursor advance

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

CVE-2026-89658 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40cleanadminrevoked takes a stateid reference under clp-cllock, drops nn-clientlock, and calls nfsd4droprevokedstid, which dereferences the stateid's...

CVE-2026-89656 libceph: reject buckets with mismatched CRUSH ids

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89655 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-89654 ceph: fix UAF in check_new_map() on session freed during unlock

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...