Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-13 19:10Z
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89677 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89677

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89676 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89676

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole back CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89675 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89675

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89674 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client: - fh_len doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually writes "4 + xdr_align_ CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89672 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both po CVSSv3.1 9.1 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89671 — Linux: A NULL pointer that means "the client did not send this arm" is therefore

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89671

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and argp->acl_default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set: nfs3svc_decode_setaclargs() if (args->mask & NFS_ACL) decode into acl_access if (args->mask & NFS_D CVSSv3.1 9.1 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89669 — Linux: A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manag CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89667 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89667

In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtable and then call nfsd_file_dispose_list_delayed() to move it to the per-net dispose list. If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk misses the already-unhashed file, and its drain of the per-net dispose list can r CVSSv3.1 8.1 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89665 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr_decode_sattr(): iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC; tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in unsigned long. On ILP32 that is 32 bits, and an out-of-range useconds value such as 4294968 wraps to tv_nsec == 704. The corruption therefo CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89663 — Linux: A second revoke or a laundromat tick then frees it while the reader still

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent stid's sc_cp_list, pinned by a single membership reference. _free_cpntf_state_locked() only unlinks an entry once its refcount reaches zero, so any revoke path that runs while a concurrent find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops the ref CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89662 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on eac CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89660 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89659 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89659

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The client survives its stateids only because __destroy_client() drains cl_delegations and cl_revoked before free_client() runs. nfs4_laundromat() breaks that invariant: it unhashes an expired delegation from cl_delegations, drops deleg_lock, the CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89658 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89658

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_s CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89656 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89655 — Linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacqui CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89654 — Linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89654

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock( CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89653 — Linux: In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array. Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89652 — Linux: Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() co CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89651 — Linux: A malicious or compromised MDS can trigger this with the first post-connect message on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode va CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89650 — Linux: When the monitor sends an MDS map whose per-mds info version is 2 or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89650

In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89649 — Linux: Add the missing ceph_decode_need() so an out-of-bounds value length on the final attribute fails

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length, records the value pointer, and advances past the value bytes. The two length fields are read with ceph_decode_32_safe(), but the value bytes themselves are advanced over wi CVSSv3.1 9.1 (CRITICAL) · EPSS 9th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89643 — Linux: In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89643

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself. The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89637 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89637

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89636 — Linux: If ce->tgthint is not reset before it is used later, it results in a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89636

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score