Vulnarycritical

the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

2,516critical tracked/82new today/39known-exploited/1exploit available/2,516critical tracked/82new today/39known-exploited/1exploit available/2,516critical tracked/82new today/39known-exploited/1exploit available/2,516critical tracked/82new today/39known-exploited/1exploit available/

The feed (latest)

2,516 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-89708

A critical use‑after‑free flaw exists in the Linux kernel’s NFS server (nfsd). The bug allows an attacker to free a session while the kernel’s RPC subsystem still holds a reference to it, potentially leading to memory corruption. The issue has been fixed in the kernel source code.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89703

A critical bug in the Linux kernel’s NFS server can cause a use‑after‑free when an administrator revokes a delegation. The flaw occurs because a flag is not set, allowing a freed delegation to be added to a list that is later traversed. This could let an attacker crash the server or potentially execute code.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89702

CVE-2026-89702 is a critical kernel memory‑corruption bug in the NFS server code that can be triggered by crafted UDP NFS requests. The issue has been fixed by correcting the size of the server sockaddr slot in the nfsd tracepoints.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89697

A critical flaw in the Linux kernel's NFS server could allow an attacker to compromise the integrity and availability of the system by manipulating file attributes without proper write permissions. The issue was fixed by adding a missing write reference check during attribute changes. The vulnerability is now patched in updated kernel releases.

Critical· 9.1<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89689

A critical flaw in the Linux kernel’s NFS server (nfsd) implementation allows the kernel to free session slots that are still in use, causing memory corruption. The bug occurs when the session shrinker reduces the maximum slot count while a client continues to reference slots in the higher range, and the code fails to verify that the current slot is within the new limit and that the slot is not actively in use before freeing it.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89688

A critical flaw in the Linux kernel’s NFS server can cause a use‑after‑free that may crash the system or allow arbitrary code execution. The bug was fixed in the kernel, so newer releases contain the patch.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89686

A race condition in the Linux NFS server can cause a kernel crash when two clients interact with a delegated file. The flaw allows an attacker to trigger a BUG_ON that brings down the system. It has been fixed in a recent kernel update.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89681

A race condition in the Linux kernel’s NFS server can cause a layout state ID to leak, potentially leading to resource exhaustion or crashes. The issue has been fixed in a kernel update that removes the double-reference bug in the layout fence worker. Users should update to a kernel version that includes this patch.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89677

A flaw in the Linux kernel’s NFS server could let a malicious client cause the server to use the wrong directory entry, potentially leading to data corruption or unauthorized access.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89676

A critical flaw in the Linux kernel’s NFS server could let an attacker corrupt memory during asynchronous copy operations. The bug involves a dangling pointer to a temporary buffer that can be exploited to crash the system or potentially run arbitrary code. The issue has been fixed in recent kernel updates.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89675

A critical use‑after‑free bug in the Linux kernel’s NFS server could let an attacker crash or potentially run code by manipulating async copy operations during shutdown or cancellation. The issue was fixed in a kernel patch that corrects race conditions and reference counting in the async copy logic. Users should update to a kernel version that includes this patch.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89674

A critical vulnerability in the Linux kernel's NFS daemon (nfsd) stems from faulty XDR buffer size calculations in the nfsd4_ff_encode_layoutget function. This can result in out-of-bounds writes or the exposure of uninitialized kernel memory to clients. The issue carries a CVSS score of 9.8 and has been addressed in the kernel.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89672

A flaw in the Linux kernel’s NFS server can let an attacker delete or modify directory access control lists without permission. The bug occurs when the server misinterprets ACL update requests, causing default ACLs to be removed silently. The issue is critical because it can compromise file permissions on any system using NFS.

Critical· 9.1<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89671

A flaw in the Linux kernel’s NFSv3 setacl handling could let an attacker delete or alter file access controls. The bug misinterprets missing ACL data as a removal, causing ACLs to be unintentionally dropped. The issue has been fixed in the kernel.

Critical· 9.1<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89669

A critical flaw in the Linux kernel’s NFS server could let an attacker cause a use‑after‑free error, potentially leading to arbitrary code execution. The issue was fixed in a kernel update.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89662

A critical bug in the Linux kernel’s NFS daemon could let an attacker crash the server by freeing a lock owner that is still in use, causing a NULL dereference during client teardown.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89660

A race condition in the Linux kernel's NFSv4 admin state revocation can cause a client structure to be freed while a stateid is still being revoked, leading to a use‑after‑free. The fix pins the client reference during revocation and ensures teardown waits for the reference to drop. Update the Linux kernel to a version that includes this fix.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d

CVE-2026-89659

A critical bug in the Linux kernel’s NFS server could let a client use a freed memory pointer during delegation revocation, potentially allowing an attacker to crash the system or execute arbitrary code. The issue has been fixed in the kernel, so updating to a patched version resolves the risk.

Critical· 9.8<1% likelyfix available

published 2d agodeletes in 30d