Kernel CVE Batch Analysis: September 11, 2026 (431 CVEs, a file-server batch)

On September 11, 2026 the Linux kernel project published 431 CVEs in a single day — the largest batch since the 346-CVE drop on August 10. Unlike that batch, NVD was already partway through this one: at analysis time 278 of the 431 carried an NVD score, and the remaining 153 are KernelScan provisional assessments pending NVD analysis. The severity split is unusually top-heavy: 71 Critical, 213 High, 116 Medium, 31 Low, and 284 of the 431 rated 7.0 or higher.

And the shape of the batch is the story. This is not a driver-of-the-week dump. It is a file-server patch day: 53 of the 71 Criticals sit in the NFS server, SUNRPC/Kerberos, RPC-over-RDMA, Ceph, SMB and OCFS2 code — the subsystems a storage appliance exposes to its clients and peers. If you ship an NFSD-exporting NAS, a Ceph-backed storage node, or an SMB file server, today is your day. The useful question, as always, is which of these reach the build you actually ship.

The batch at a glance

The standouts

The lead Critical of the batch is about as clean as remote kernel bugs get: CVE-2026-89659 (Critical 9.8), a use-after-free in the kernel NFS server’s delegation-revocation path. Any NFS client that holds an NFSv4 delegation and lets it time out can race the server’s laundromat against client teardown, freeing the client object while the revoke path still dereferences it. No authentication beyond being an NFS client, no local access, introduced in 3.10 — so every maintained branch is exposed. If your product exports NFSv4 with delegations enabled (CONFIG_NFSD), this is the one to check first, together with its siblings CVE-2026-89712 (Critical 9.8), CVE-2026-89703 (Critical 9.8) and CVE-2026-89660 (Critical 9.8), which all race client teardown against revocation or session-state cleanup.

The second standout looks identical and is not. CVE-2026-89656 (Critical 9.8) is an out-of-bounds write in the kernel Ceph client’s CRUSH-map decoder — but the attacker has to be a malicious or compromised Ceph monitor, or an on-path attacker between client and cluster. That is a trusted-infra threat model, not an internet-facing one: the score is real, the reachable population is “Ceph clients whose monitor they don’t trust,” and a sealed appliance talking only to its own cluster has a very different conversation about it. Introduced in 4.11, so the exposure window is a decade wide wherever Ceph is in the product.

CVE-2026-80926 (Critical 9.8) completes the trio: a use-after-free in ksmbd, the in-kernel SMB server, reachable by any authenticated SMB client holding a durable oplock and racing a disconnect. Samba-based appliances are unaffected; anything shipping ksmbd (CONFIG_SMB_SERVER) behind client-visible SMB shares should treat it as remotely triggerable.

The high-rated CVEs, grouped by where they bite

The kernel NFS server — 54 CVEs, 21 Critical

The single biggest block of the batch, and almost all of it client-reachable server code: stateid and delegation lifetime bugs (CVE-2026-89659 through the revocation series), session-slot and replay races (CVE-2026-89689, Critical 9.8), async-copy teardown (CVE-2026-89675, Critical 9.8), decoder hardening against malformed compounds, and CVE-2026-89713 (Critical 9.1), a TOCTOU that lets a client append to append-only files by racing SETATTR against the size check. The gate is CONFIG_NFSD; the secondary gates are which NFS versions (CONFIG_NFSD_V4 and friends) and whether delegations are in use.

SUNRPC and RPCSEC_GSS Kerberos — 12 CVEs, 8 Critical

A hardening series against short and oversized tokens in the krb5 MIC and wrap/unwrap paths: CVE-2026-89537 (Critical 9.1), CVE-2026-89542 (Critical 9.8), CVE-2026-89550 (Critical 9.8) and five more. All of them require the peer to speak sec=krb5 RPC — a malicious NFS server attacking a client, or a malicious client attacking a server. Sites running sec=sys everywhere are spectators; sites that moved to Kerberos for NFS (and many security-hardened appliances have) are on both ends. Note the fix clock here: the MIC fix is in 7.2.4 and mainline only, not the 6.x stable series at analysis time. Gate: CONFIG_SUNRPC_GSS.

RPC-over-RDMA (svcrdma) — 10 CVEs, 4 Critical

Chunk-list and inline-reply validation in the RDMA transport for NFS: oversized Read segments, unvalidated chunk positions, reply pull-up overflows (CVE-2026-89526, Critical 9.8). Reachable by RDMA-capable NFS clients against an RDMA-enabled server. Gate: CONFIG_SUNRPC_XPRT_RDMA. A concrete filter: NFS over TCP is unaffected even where CONFIG_NFSD is on.

Ceph client — 12 CVEs, 8 Critical

Besides the CRUSH-map overflow above, a systematic pass over every unbounded decode in the MDS-map, session, xattr and capability paths: CVE-2026-89651 (Critical 9.8), CVE-2026-89650 (Critical 9.1), CVE-2026-89655 (Critical 9.8). The attacker class is consistent throughout: the cluster side (monitor or MDS), not arbitrary network peers. Gates: CONFIG_CEPH_FS, CONFIG_CEPH_LIB, CONFIG_BLK_DEV_RBD.

SMB, both directions — 10 CVEs, 8 Critical

Server side (ksmbd): the oplock-break use-after-free above plus CVE-2026-89635 (Critical 9.8), a durable-handle reconnect rebinding every detached oplock to the reconnecting session. Client side (kernel SMB client): CVE-2026-89637 (Critical 9.8) frees a response buffer on a malformed TRANSACT2 secondary, and CVE-2026-89636 (Critical 9.8) leaves a DFS-cache target hint dangling. A client mounting untrusted SMB shares is a rarer product than a server, but both ends moved today. Gates: CONFIG_SMB_SERVER (ksmbd), CONFIG_CIFS (client).

OCFS2 and its cluster DLM — 7 CVEs, 3 Critical

A wire-protocol hardening series in the o2dlm: CVE-2026-89494 (Critical 9.8) and CVE-2026-89495 (Critical 9.8) trust peer-supplied lock-migration fields, CVE-2026-89492 (Critical 9.8) trusts on-disk directory-index counts, and the o2hb heartbeat side got its own fixes. The split that matters: the DLM bugs need a peer inside the cluster domain, the on-disk validators need a crafted filesystem. Gate: CONFIG_OCFS2_FS.

NTFS and untrusted images — 5 CVEs, 5 Critical

CVE-2026-89613 (Critical 9.8), CVE-2026-89612 (Critical 9.8) and CVE-2026-89610 (Critical 9.8) parse attacker-supplied NTFS metadata into memory corruption and are scored Critical by NVD. Our provisional assessment is narrower: mounting requires root (or an automount path plus removable media), so the realistic attacker is a crafted disk image on a product that automounts USB — kiosks, desktops, forensics gear — not a headless server. Also new code: introduced in 7.1, fixed in 7.2.4 and mainline only, so nothing older than 7.1 is exposed. Gate: CONFIG_NTFS_FS.

Transports and network paths

SCTP got two peer-reachable use-after-frees in chunk processing (CVE-2026-89479, Critical 9.8; CVE-2026-89478, Critical 9.8) — one bundled-packet lifetime bug that has been there since 2.6.12. SMC-R (IBM RDMA-over-ETH convergence) got a peer-driven out-of-bounds read in LLC link negotiation (CVE-2026-80986, Critical 9.8). MPLS multipath (CVE-2026-89555, Critical 9.8) and SRv6 decap (CVE-2026-80976, Critical 9.8 — our provisional read: local unprivileged via netns, 7.1) round out the list, plus CVE-2026-81002 (Critical 9.8), an AF_XDP zero-copy frame-layout overflow our assessment gates behind CAP_NET_ADMIN.

Local kernel core — the batch’s quiet half

Two thematic series for the multi-tenant-host crowd: an AppArmor credential-lifetime fix (CVE-2026-89762, High 7.8 — requires the ability to update AppArmor profiles, so admin-adjacent rather than any-user) and a long tracing/ring-buffer series (sub-buffer resize, named triggers, user-events; CVE-2026-89771, High 7.8), plus mm and BPF verifier fixes (CVE-2026-89581, High 7.8). These matter on hosts where untrusted local code runs; on a sealed appliance they are mostly noise.

The one that corrupts data instead of memory

CVE-2026-89558 (Critical 9.8 by NVD; our provisional 5.1) is an inverted boolean in RAID10 recovery: re-adding a disk to a degraded array with an internal bitmap can mark it in-sync while it holds stale data — silent, on-disk corruption with the array reporting clean. It needs an administrator managing disks, not an attacker, but it silently destroys the product’s core promise. Storage appliances on 6.12+ with RAID10 and internal bitmaps: check resync behavior after degraded writes before you ship the update. Introduced in 6.12, fixed in 6.12.109, 6.18.50 and 7.2.4.

Appliance triage

A useful example: seven CVEs, one config symbol, two attacker classes

Take the OCFS2 cluster. All seven of its CVEs — the three Criticals in the DLM wire handlers, the on-disk validators, the heartbeat fixes — disappear the moment CONFIG_OCFS2_FS is unset, which is the case for every product that is not deliberately building an OCFS2 cluster. That is the first filter, and it retires seven Criticals in one line of the config audit.

The second split is attacker class. NVD scores CVE-2026-89494 at 9.8 network-vector; our provisional assessment is 8.0 with adjacent-network access and privileges — because the malformed migration message has to come from a node inside the DLM domain. So the honest VEX statement splits OCFS2 products in two: a clustered OCFS2 deployment is affected through its peer nodes and should patch; a product merely carrying the module gets code not in reach — not because the code is absent, but because the attacker who can reach it does not exist in its threat model. Same CVE id, two correct answers, and the difference is one Kconfig symbol and one question about who your product’s peers are.

Medium and low still matter

The 116 Mediums are where product-specific judgment lives: 47 of them are drivers (a long power-supply and HID teardown series — use-after-free on driver unbind, which only bites products that hot-unplug hardware), the rest spread across network paths, filesystems and platform code. A Medium in the exact subsystem your appliance ships will outrank a generic High in code you never load — the efiivarfs, zram and hp-bioscfg entries in this batch are good examples of fixes that are boring in a CVSS sort and urgent in a product sort.

Compliance output should say why

Every CVE your tooling emits a verdict for should carry its reason. The four VEX statuses map cleanly onto this batch: affected (NFS-exporting appliance with delegations, vs. CVE-2026-89659), not affected — code not reachable (no CONFIG_OCFS2_FS, vs. the DLM series), under investigation (the 153 NVD-unscored entries, honestly labeled provisional), and mitigated / fixed (already on 6.12.109+ where the fix landed). An SBOM consumer that cannot see why a 9.8 was dismissed will either panic or ignore you; both are expensive.

How KernelScan helps

KernelScan runs this exact analysis against your kernel build: upload the .config, and every CVE in the batch is resolved against the symbols you actually enable — attacker class included, so a 9.8 that needs a cluster peer, a crafted disk or CAP_NET_ADMIN arrives pre-deflated with its reasoning attached. The batch data in this post is the same corpus the product triages against, and the per-CVE cards linked above carry the full analysis for each entry.

The fixes are in the current stable series: 6.12.109, 6.18.50/51, 7.2.4/7.2.5, and mainline 7.3-rc1/rc2 (a few entries, including the NTFS series and the krb5 MIC fix, landed in 7.2.4 and mainline only). If your branch is covered, take the update; if it is not, the reachability questions above are how you decide whether that is tolerable.