Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
dentry_create() can hypothetically provide a different dentry than the
one passed in. This could happen, for example, if the exported
filesystem is NFS, and the server returned to OPEN a filehandle which
matched a directory that was already in the dcache. Clearly this would
not be expected!
If this were to happen the dentry (child) that was already stored in
resfhp could be freed and later dereferenced.
We shouldn't call fh_compose() until we are certain that we have the
final dentry, so this patch moved the fh_compose() call to two places:
one for the case where the target already exists, and one after
dentry_create() where it was created.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 7.0 | 7.2.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.2.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | linux | 7.0.0-42.42 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1016.17 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1016.18 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1017.17 | USN-8960-1, USN-8959-1 |
| Ubuntu 26.04 LTS | linux-nvidia +1 | No fix yet | — |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1015.16 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv | 7.0.0-42.42.1 | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-42.42~24.04.1 | USN-8959-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-riscv +27 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-42.42.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.2.6-1.1 | openSUSE-SU-2026:11805-1 |
Advisories 7
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-3321 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8960-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- openSUSE-SU-2026:11805-1 kernel-devel-7.2.6-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026