Linux kernel.

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

• Linux kernel

nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

• Linux kernel

nfsd: release path refs on follow_down() error

• Linux kernel

nfsd: Reset write verifier when async COPY writeback fails

• Linux kernel

nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths

• Linux kernel

nfsd: sample writeback error cursor before async COPY loop

• Linux kernel

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

• Linux kernel

nfsd: size fh_verify server sockaddr slot by xpt_locallen

• Linux kernel

nfsd: validate nseconds in TIME_DELEG decode paths

• Linux kernel

nfsd: validate sockaddr length per family in listener_set

• Linux kernel

nfsd: validate symlink target length in NFSv4 CREATE

• Linux kernel

nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

• Linux kernel

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

• Linux kernel

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

• Linux kernel

nfsd: cap decoded POSIX ACL count to bound sort cost

• Linux kernel

nfsd: check client ownership when cancelling a copy-notify stateid

• Linux kernel

nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()

• Linux kernel

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

• Linux kernel

nfsd: clear opcnt on compound arg release to prevent OOB read

• Linux kernel

nfsd: defer vfree of compound ops to fix rpc_status UAF

• Linux kernel

nfsd: don't free session slots that are still in use

• Linux kernel

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

• Linux kernel

nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file

• Linux kernel

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

• Linux kernel

nfsd: fix clock domain mismatch in clients_still_reclaiming()

• Linux kernel

nfsd: fix cpntf publish race in nfs4_init_cp_state

• Linux kernel

nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

• Linux kernel

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

• Linux kernel

nfsd: fix layout fence worker double-reference race

• Linux kernel

nfsd: fix nfsd_file leak on inter-server COPY setup failure

• Linux kernel

nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

• Linux kernel

nfsd: fix partial-write detection in nfsd_direct_write

• Linux kernel

nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

• Linux kernel

nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

• Linux kernel

nfsd: fix UAF in async copy cancel and shutdown

• Linux kernel

nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

• Linux kernel

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

• Linux kernel

nfsd: gate nfs2 setacl by argp->mask

• Linux kernel

nfsd: gate nfs3 setacl by argp->mask

• Linux kernel

nfsd: hold rcu across localio cmpxchg retry

• Linux kernel

nfsd: initialize copy-notify stateid before publishing it

• Linux kernel

nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

• Linux kernel

nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache

• Linux kernel

nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

• Linux kernel

nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

• Linux kernel

nfsd: release OPEN-decoded posix ACLs via op_release

• Linux kernel

nfsd: revoke copy-notify stateids before dropping their reference

• Linux kernel

NFSD: Prevent lock owner use-after-free during client teardown

• Linux kernel

NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

• Linux kernel

NFSD: Prevent client use-after-free during admin state revocation

• Linux kernel

NFSD: Prevent client use-after-free during delegation revoke

• Linux kernel

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

• Linux kernel

libceph: validate OSD extent maps before cursor advance

• Linux kernel

libceph: reject buckets with mismatched CRUSH ids

• Linux kernel

ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

• Linux kernel

ceph: fix UAF in check_new_map() on session freed during unlock

• Linux kernel

ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

• Linux kernel

ceph: bound copied dentry name length in NFS export get_name

• Linux kernel

ceph: bound MDSCapAuth path and fs_name decode in handle_session()

• Linux kernel

ceph: bound num_export_targets array for mds info v2/v3

• Linux kernel