https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:03:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-43470 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfs: return EISDIR on nfs3_proc_create if d_alias is a dir</p> <p>If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don&#39;t return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative.</p> <p>This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open.</p> <p>This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection).</p> <p>While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don&#39;t attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfs: return EISDIR on nfs3_proc_create if d_alias is a dir</p> <p>If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don&#39;t return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative.</p> <p>This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open.</p> <p>This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection).</p> <p>While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don&#39;t attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.</p> https://cve.radiocsirt.org/vuln/cve-2026-43470