Description
In the Linux kernel, the following vulnerability has been resolved:
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
If we found an alias through nfs3_do_create/nfs_add_or_obtain
/d_splice_alias which happens to be a dir dentry, we don't return
any error, and simply forget about this alias, but the original
dentry we were adding and passed as parameter remains negative.
This later causes an oops on nfs_atomic_open_v23/finish_open since we
supply a negative dentry to do_dentry_open.
This has been observed running lustre-racer, where dirs and files are
created/removed concurrently with the same name and O_EXCL is not
used to open files (frequent file redirection).
While d_splice_alias typically returns a directory alias or NULL, we
explicitly check d_is_dir() to ensure that we don't attempt to perform
file operations (like finish_open) on a directory inode, which triggers
the observed oops.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.10 | 6.12.78 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.19.10-1 | — |
| Debian 13 | linux | 6.12.85-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv +26 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +6 | 6.4.0-150700.53.60.1 | SUSE-SU-2026:2482-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.60.1.150700.17.35.4 | SUSE-SU-2026:2482-1 |
| SLES 15 SP7 | kernel-obs-build | 6.4.0-150700.53.60.2 | SUSE-SU-2026:2482-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.36.1 | SUSE-SU-2026:22769-1, SUSE-SU-2026:22742-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-47.1.21.24 | SUSE-SU-2026:22137-1 |
| SLE Micro 6.1 | kernel-rt +1 | 6.4.0-48.1 | SUSE-SU-2026:22458-1 |
| SLE Micro 6.1 | kernel-source +2 | 6.4.0-47.1 | SUSE-SU-2026:22137-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-47.1.21.24 | SUSE-SU-2026:22108-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-48.1 | SUSE-SU-2026:22433-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-47.1 | SUSE-SU-2026:22108-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.60.1 | SUSE-SU-2026:2482-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_16 | 1-150700.1.5.2 | SUSE-SU-2026:2591-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_16 | 1-150700.15.3.2 | SUSE-SU-2026:2482-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +1 | 6.4.0-150700.7.59.2 | SUSE-SU-2026:2591-1 |
| SUSE Real Time Module 15 SP7 | kernel-syms-rt | 6.4.0-150700.7.59.1 | SUSE-SU-2026:2591-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | openSUSE-SU-2026:21388-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.36.1 | openSUSE-SU-2026:21388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.20-20.229 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-1596, ALAS2023-2026-1594 |
| Amazon Linux 2023 | perf6.12 +14 | 1:6.12.79-101.147.amzn2023 | ALAS2023-2026-1594 |
| Amazon Linux 2023 | perf6.18 +14 | 1:6.18.20-20.229.amzn2023 | ALAS2023-2026-1596 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-204.92.4.2.el10uek | ELSA-2026-50372 |
Advisories 15
- WID-SEC-2026-1454 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:22835-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22812-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2026:21388-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22769-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:22742-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:22458-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:22433-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 3, 2026
- ELSA-2026-50372 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 2, 2026
- SUSE-SU-2026:2591-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:2482-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22137-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 18, 2026
- SUSE-SU-2026:22108-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- ALAS2023-2026-1594 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026
- ALAS2023-2026-1596 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026