In the Linux kernel, the following vulnerability has been resolved:
NFSv4: remove callback IDR entry on client allocation failure
nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfs_client directly with nfs_free_client(). That bypasses nfs_put_client(), which is where the callback IDR entry is removed during normal teardown.
A failed allocation can therefore leave cb_ident_idr pointing at a freed nfs_client. A later NFSv4.0 callback lookup by cb_ident would find the stale pointer and take a reference to it.
Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client.
This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.188-233.385Upgrade kernel-headers | Oct 13, 2026 | Sep 17, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 30, 2026 | Sep 17, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2026 | Sep 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub