[Git][security-tracker-team/security-tracker][master] Add CVE-2026-89096 and CVE-2026-89098 for nfs-utils

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d696f229 by Salvatore Bonaccorso at 2026-10-17T10:55:34+02:00
Add CVE-2026-89096 and CVE-2026-89098  for nfs-utils

For LTS: Perfer if those are can be kept under kernel-team maintenance.
So consider marking them postponed and if an update will be needed they
will follow only once we did as well trixie.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -27,7 +27,10 @@ CVE-2026-92431 (The Patreon WordPress plugin before 1.10.0 does not perform an a
 CVE-2026-91074 (The BSK PDF Manager WordPress plugin through 3.8.1 does not properly s ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-89096 (A flaw was found in nfs-utils. An unauthenticated remote attacker can  ...)
-	TODO: check
+	- nfs-utils 1:3.1.1-1
+	[trixie] - nfs-utils <no-dsa> (Minor issue; potential update will be handled within kernel-team)
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462372
+	NOTE: Fixed by: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=73cebb0d987cdaa8266b7db6fc6ca21bc59d1555 (nfs-utils-2-9-3-rc4)
 CVE-2026-81344 (The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-81343 (The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13  ...)
@@ -224,7 +227,10 @@ CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server. Fr
 CVE-2026-90821 (An input neutralization vulnerability in the Webhook URL form field co ...)
 	NOT-FOR-US: Crafty Controller
 CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd daemon improperly handles inp ...)
-	TODO: check
+	- nfs-utils 1:3.1.1-1
+	[trixie] - nfs-utils <no-dsa> (Minor issue; potential update will be handled within kernel-team)
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2469511
+	NOTE: Fixed by: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=32d2a1581911b418f3bdf0537a19236730df6816 (nfs-utils-2-9-3-rc4)
 CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically establish conn ...)
 	NOT-FOR-US: Z.ai ZCode
 CVE-2026-87111 (The User Registration PRO \u2013 Custom Registration Form, Login Form, ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d696f2296ce751cff778d032bf4e08fae3c9a67e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d696f2296ce751cff778d032bf4e08fae3c9a67e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/e74ae48d/attachment.htm>