CVE-2026-89552

This Linux kernel vulnerability affects param_set_charp() in the kernel's params subsystem. The root cause is that the previous parameter value is freed before the replacement allocation succeeds; if kmalloc_parameter() fails, the parameter is left as NULL , leading to a kernel NULL pointer deref...

CVE-2026-89551

CVE-2026-89551 is a Linux kernel vulnerability in the SUNRPC subsystem, specifically in xdr_buf_trim(). The root cause is an unsigned integer underflow : when buf->len is smaller than the sum of the iovec lengths, the final accounting step (buf->len -= (len - trim)) wraps to near UINT_MAX. ...

CVE-2026-89550

CVE-2026-89550 affects the Linux kernel in the SUNRPC svcauth_gss subsystem. The function svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length before passing it to the GSS unwrap path. A token with a length in the range [0, 16] passes this check and rea...

CVE-2026-89548

This Linux kernel vulnerability affects the SUNRPC subsystem. In sunrpc_destroy_cache_detail(), the global cache_cleaner delayed work is only cancelled when cache_list is empty. During per-netns teardown , cache_list is never empty because init_net caches remain registered, so the cancel never fi...

CVE-2026-89549

CVE-2026-89549 affects the Linux kernel sunrpc subsystem . When a service such as nfsd is configured with fewer threads than pools (e.g., fewer threads than the host's NUMA nodes in pernode or percpu mode), trailing pools are left without threads. The function svc_xprt_enqueue() can then route a ...

CVE-2026-89547

This Linux kernel vulnerability affects the SUNRPC subsystem. __svc_create() initializes three per-pool percpu_counter stats but ignores all return values from percpu_counter_init(). On SMP systems, a failed per-cpu allocation leaves the counter's backing pointer NULL while the half-constructed s...

CVE-2026-89546

CVE-2026-89546 is a race condition in the Linux kernel's SUNRPC subsystem affecting the NFS callback service teardown path. During shutdown, a backchannel receive can complete a request concurrently with the destruction of the callback service. If xprt->bc_serv is already cleared, the committe...

CVE-2026-89545

CVE-2026-89545 is a use-after-free in the Linux kernel sunrpc subsystem. The function svc_rqst_free() freed rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), while the rqstp struct itself was deferred via kfree_rcu(). After svc_exit_thread() calls list_del_rcu() and svc_rqst_free...

CVE-2026-89544

CVE-2026-89544 affects the Linux kernel's SUNRPC subsystem, specifically the gssx XDR option-array decoder (gssx_dec_option_array()). Four coupled defects in its error paths are: (1) a NULL pointer dereference in the caller when oa->count is set to 1 before oa->data is allocated and the all...

CVE-2026-89543

CVE-2026-89543 is a use-after-free vulnerability in the Linux kernel's sunrpc subsystem. The root cause is that the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() without refreshing the clnt->pipefs_sb field, and the umount path removes the directory without clearin...

CVE-2026-89542

CVE-2026-89542 affects the Linux kernel SUNRPC subsystem, specifically the gss_krb5_unwrap_v2() function used during Kerberos GSS authentication. The function reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least 16 bytes long, and its rotate_left() he...

CVE-2026-89541

CVE-2026-89541 affects the Linux kernel's SUNRPC subsystem in the function gss_unwrap_resp_priv(). The root cause is a u32 integer overflow in the RPCSEC_GSS opaque length validation: when opaque_len is near 0xffffffff, the sum offset + opaque_len wraps to a small value, bypassing the bound check...

CVE-2026-89540

CVE-2026-89540 is a race condition in the Linux kernel 's sunrpc subsystem. The function create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before mutex_init() is called on sn->gssp_lock. A userspace write that lands in the narrow preemption window b...

CVE-2026-89539

Linux kernel SUNRPC subsystem: gssx_dec_option_array() processes wire-supplied GSS option entries and calls gssx_dec_linux_creds() for each CREDS_VALUE match. Because that helper unconditionally overwrites creds->cr_group_info without releasing the previous pointer, a reply containing two CRED...

CVE-2026-89538

CVE-2026-89538 affects the Linux kernel SUNRPC subsystem. The vulnerability resides in gss_krb5_unwrap_v2() , where a peer holding a valid GSS context can encrypt a Kerberos v2 wrap token whose 16-bit "extra count" (ec) field exceeds the plaintext length. Although a prior fix clamped the subtract...

CVE-2026-89537

CVE-2026-89537 is an out-of-bounds read in the Linux kernel 's SUNRPC subsystem, specifically in gss_krb5_verify_mic_v2() . The function reads the token ID, flags byte, and padding from a GSS-KRB5 MIC token without first checking read_token->len against the minimum safe size of GSS_KRB5_TOK_HD...

CVE-2026-89536

CVE-2026-89536 affects the Linux kernel SUNRPC subsystem. The root cause is a race condition between cancellation and completion during a client-side TLS handshake. When xs_tls_handshake_sync() drops its reference to the lower transport after calling tls_handshake_cancel(), the completion callbac...

CVE-2026-89535

CVE-2026-89535 is a use-after-free vulnerability in the Linux kernel's svcrdma (RDMA-based NFS server) subsystem. In svc_rdma_free(), the call to rdma_destroy_id(sc_cm_id) frees the CM ID while the transport's sc_rn notification entry remains installed in the device's rd_xa xarray until the subse...

CVE-2026-89534

CVE-2026-89534 affects the Linux kernel's svcrdma (SCS RDMA) subsystem. When svc_rdma_listen_handler() processes an RDMA_CM_EVENT_ADDR_CHANGE event, it allocates a replacement listener cm_id and signals the CM core to destroy the old one. If the replacement allocation fails , sc_cm_id still point...

CVE-2026-89533

CVE-2026-89533 is a Linux kernel vulnerability in the svcrdma (NFS/RDMA server) subsystem. Two arithmetic defects in svc_rdma_read_chunk_range() cause incorrect DMA lengths and a u32 underflow : a boundary check uses > instead of >=, and the offset subtraction is applied outside the min_t()...