CVE-2026-89662

This is a use-after-free vulnerability in the Linux kernel's NFSD (NFS server daemon) during client teardown. When __destroy_client() releases a client's owners, a lock owner whose only reference is a blocked lock remains on the owner hash table. Because client_has_state() does not count such a b...

CVE-2026-89660

CVE-2026-89660 is a use-after-free vulnerability in the Linux kernel NFSD (NFS server) subsystem, triggered during admin state revocation. A stateid holds only a bare pointer to its nfs4_client and does not pin it; the client survives only because __destroy_client() drains its stateids before fre...

CVE-2026-89659

A use-after-free vulnerability exists in the Linux kernel's NFSD (NFSv4 server) subsystem during delegation revocation. A delegation stateid holds only a bare pointer to its owning nfs4_client without keeping it alive. The nfs4_laundromat() function breaks the safety invariant: it unhashes an exp...

CVE-2026-89657

CVE-2026-89657 is a vulnerability in the Linux kernel's libceph client (net/ceph/osd_client.c). The function osd_sparse_read() validates that sparse-read data length matches summed extent lengths but fails to verify that each OSD-supplied extent is monotonic and within the original request range....

CVE-2026-89658

CVE-2026-89658 affects the NFSD subsystem of the Linux kernel . The vulnerability is a use-after-free during NFSv4.0 revoked-state cleanup: nfs40_clean_admin_revoked() drops nn->client_lock before calling nfsd4_drop_revoked_stid(), which then dereferences the client via s->sc_client->cl_...

CVE-2026-89656

CVE-2026-89656 affects the libceph subsystem of the Linux kernel . The vulnerability resides in crush_decode() , which stores CRUSH bucket data by array slot. A malformed CRUSH map can encode a bucket id that does not match its array slot, causing the mapper to alias one bucket into another's wor...

CVE-2026-89654

CVE-2026-89654 is a Use-After-Free (UAF) in the Linux kernel's Ceph filesystem (ceph), specifically in check_new_map(). Three code paths—address changed, reconnect, and active transition—drop mdsc->mutex without acquiring an additional reference on the MDS session object. During the unlock win...

CVE-2026-89655

CVE-2026-89655 is a Use-After-Free (UAF) vulnerability in the Linux kernel's Ceph filesystem (ceph) module . The flaw occurs in __kick_flushing_caps(), which iterates over ci->i_cap_flush_list while temporarily dropping i_ceph_lock to send cap messages. During that unlock window, handle_cap_fl...

CVE-2026-89653

This vulnerability affects the Linux kernel's Ceph filesystem (ceph) MDSMap decode path . The check_new_map() function uses monitor-controlled export_targets entries as bit numbers in a fixed stack bitmap. A rank value at or above CEPH_MAX_MDS causes set_bit() to write past the end of the array, ...

CVE-2026-89652

CVE-2026-89652 is a slab out-of-bounds write in the Linux kernel's Ceph filesystem NFS export path. The functions ceph_get_name() and __get_snap_name() copy MDS-supplied dentry names into a NAME_MAX-sized buffer via memcpy without validating the length against NAME_MAX. A malicious or compromised...

CVE-2026-89651

CVE-2026-89651 affects the Linux kernel Ceph MDS client . In handle_session(), the match.path and match.fs_name byte strings within MDSCapAuth records are decoded using a bare ceph_decode_copy() without the required ceph_decode_need() bounds check. A malicious or compromised MDS can craft a CEPH_...

CVE-2026-89649

CVE-2026-89649 affects the Linux kernel's CephFS subsystem. The function __build_xattrs() decodes xattr blobs supplied by the Ceph metadata server (MDS) but fails to verify that the final attribute's value length does not exceed the remaining bytes in the blob — it advances the pointer with a bar...

CVE-2026-89650

CVE-2026-89650 affects the Linux kernel's CephFS client in fs/ceph/mdsmap.c. The function ceph_mdsmap_decode() reads num_export_targets from per-MDS info records and advances the decode cursor by num_export_targets * sizeof(u32) without verifying that enough bytes remain. The upper-bound check is...

CVE-2026-89648

CVE-2026-89648 affects the Linux kernel Ceph filesystem client . The vulnerable function, ceph_parse_deleg_inos() , decodes delegated inode interval sets from MDS replies but performs no bounds check on the 64-bit len field, which is fully attacker-controlled. A malicious or compromised Ceph MDS ...

CVE-2026-89647

CVE-2026-89647 is a Linux kernel vulnerability in the Ceph filesystem driver. The root cause is a busy loop in ceph_cap_reclaim_work(): it re-queues itself whenever ceph_trim_dentries() returns -EAGAIN, which occurs when a lease walk exhausts its scan budget without freeing anything. The dir-leas...

CVE-2026-89646

CVE-2026-89646 affects the Linux kernel Ceph filesystem (cephfs) . In ceph_dirty_folio(), a wrbuffer reference (via ihold()) is taken on each newly dirtied folio and is only released by writepages_finish(). When ceph_submit_write() aborts—such as during unmount when ceph_inc_osd_stopping_blocker(...

CVE-2026-89645

CVE-2026-89645 affects the btrfs filesystem in the Linux kernel. During relocation recovery , if loading a later root fails or the first transaction commit fails, btrfs_recover_relocation() exits via put_reloc_control(), which drops list-owned relocation root references but does not clear fs_root...

CVE-2026-89644

CVE-2026-89644 affects the btrfs filesystem in the Linux kernel. The root cause is an extent map reference leak in the NOCOW direct I/O write path: btrfs_get_blocks_direct_write() fails to drop the extent map obtained from btrfs_get_extent() when btrfs_create_dio_extent() returns an error (e.g., ...

CVE-2026-89643

A use-after-free vulnerability exists in the Linux kernel's audit subsystem . The function audit_del_rule() unconditionally calls audit_put_tree() at its end, assuming it always handles a temporary parser-owned tree reference. However, when invoked via fsnotify autoremove for mixed AUDIT_DIR + AU...

CVE-2026-89641

CVE-2026-89641 is a use-after-free vulnerability in the Linux kernel's CIFS filesystem . In cifs_file_set_size(), when the handle-based set_file_size() RPC fails, execution falls through to the path-based fallback which reuses a borrowed tcon pointer. If cifsFileInfo_put() had dropped the last re...