https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:56:39 +0000 https://cve.radiocsirt.org/vuln/cve-2025-71090 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()</p> <p>nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp-&gt;fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCESS_READ open from a previous OPEN operation, this action overwrites the existing pointer without releasing its reference, orphaning the previous reference.</p> <p>Additionally, the function originally stored the same nfsd_file pointer in both fp-&gt;fi_fds[O_RDONLY] and fp-&gt;fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file.</p> <p>However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released. This potentially causes open conflicts on that file.</p> <p>Then, on server shutdown, these leaks cause __nfsd_file_cache_purge() to encounter files with an elevated reference count that cannot be cleaned up, ultimately triggering a BUG() in kmem_cache_destroy() because there are still nfsd_file objects allocated in that cache.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()</p> <p>nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp-&gt;fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCESS_READ open from a previous OPEN operation, this action overwrites the existing pointer without releasing its reference, orphaning the previous reference.</p> <p>Additionally, the function originally stored the same nfsd_file pointer in both fp-&gt;fi_fds[O_RDONLY] and fp-&gt;fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file.</p> <p>However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released. This potentially causes open conflicts on that file.</p> <p>Then, on server shutdown, these leaks cause __nfsd_file_cache_purge() to encounter files with an elevated reference count that cannot be cleaned up, ultimately triggering a BUG() in kmem_cache_destroy() because there are still nfsd_file objects allocated in that cache.</p> https://cve.radiocsirt.org/vuln/cve-2025-71090 https://cve.radiocsirt.org/vuln/usn-8277-1 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: linux-hwe-6.17, Ubuntu:24.04:LTS: linux-oem-6.17, Ubuntu:Pro:Realtime:24.04:LTS: linux-realtime-6.17, Ubuntu:25.10: linux, Ubuntu:25.10: linux-aws, Ubuntu:25.10: linux-oracle, Ubuntu:25.10: linux-raspi, Ubuntu:25.10: linux-realtime</p> <p>It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)</p> <p>Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - Cryptographic API; - GPU drivers; - Ethernet bonding driver; - Network file system (NFS) server daemon; - Distributed Switch Architecture; - Netfilter; - Control group (cgroup); - Kernel kexec() syscall; - Memory management; - MAC80211 subsystem; - Multipath TCP; - Packet sockets; - TLS protocol; - Unix domain sockets; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71139, CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: linux-hwe-6.17, Ubuntu:24.04:LTS: linux-oem-6.17, Ubuntu:Pro:Realtime:24.04:LTS: linux-realtime-6.17, Ubuntu:25.10: linux, Ubuntu:25.10: linux-aws, Ubuntu:25.10: linux-oracle, Ubuntu:25.10: linux-raspi, Ubuntu:25.10: linux-realtime</p> <p>It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)</p> <p>Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - Cryptographic API; - GPU drivers; - Ethernet bonding driver; - Network file system (NFS) server daemon; - Distributed Switch Architecture; - Netfilter; - Control group (cgroup); - Kernel kexec() syscall; - Memory management; - MAC80211 subsystem; - Multipath TCP; - Packet sockets; - TLS protocol; - Unix domain sockets; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71139, CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)</p> https://cve.radiocsirt.org/vuln/usn-8277-1