https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:00:23 +0000 https://cve.radiocsirt.org/vuln/cve-2026-89694 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: check client ownership when cancelling a copy-notify stateid</p> <p>On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st-&gt;si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn-&gt;s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client&#39;s copy-notify stateid.</p> <p>Compare the creating clientid recorded in state-&gt;cp_p_clid against the requesting client&#39;s cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: check client ownership when cancelling a copy-notify stateid</p> <p>On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st-&gt;si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn-&gt;s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client&#39;s copy-notify stateid.</p> <p>Compare the creating clientid recorded in state-&gt;cp_p_clid against the requesting client&#39;s cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.</p> https://cve.radiocsirt.org/vuln/cve-2026-89694