Linux Kernel Vulnerabilities Patched

Originally published on CyberNetSec.

Executive Summary

On July 25-26, 2026, several vulnerabilities were publicly disclosed in the Linux kernel and associated open-source projects. A key vulnerability in the kernel's Network File System (NFS) server daemon (NFSD) could be triggered to create an infinite loop, resulting in a denial-of-service (DoS) condition. Separately, CVE-2026-17434 was identified in the nanocoai NanoClaw framework, a remotely exploitable flaw that could lead to improper authorization. Patches for these and other vulnerabilities have been released, and administrators of affected systems are advised to review and apply them.

---

Vulnerability Details

Linux Kernel NFSD Infinite Loop

• Description: A flaw was discovered in the Linux kernel's NFSD component that can cause an infinite loop. The issue occurs during layout state revocation because a specific status flag was not being set correctly. This causes the revocation process to repeat indefinitely, consuming CPU resources and making the NFS server unresponsive.
• Impact: This vulnerability can be triggered to cause a Denial of Service (DoS), potentially disrupting access to critical file shares.
• Affected Systems: Linux kernel versions with the vulnerable NFSD code.
• Remediation: The issue was resolved in the kernel on July 25, 2026. Users should update to a patched kernel version provided by their Linux distribution.

CVE-2026-17434: nanocoai NanoClaw Improper Authorization

• CVE ID: CVE-2026-17434
• Description: A vulnerability in the handleAddMcpServer function of the nanocoai NanoClaw framework allows for improper authorization. An attacker could potentially exploit this flaw to gain unauthorized access or perform actions they are not permitted to.
• Affected Systems: nanocoai NanoClaw versions up to and including 2.0.64.
• Exploitation: The vulnerability is listed as remotely exploitable.
• Remediation: A patch is available, and users should upgrade to a version beyond 2.0.64.

NousResearch hermes-agent Improper Access Control

• Description: A flaw was found in the SimpleX Gateway Authorization component of the NousResearch hermes-agent platform. The vulnerability involves improper access controls related to the contactId argument.
• Affected Systems: Version 2026.6.5.
• Exploitation: The attack can be launched remotely, but the complexity is rated as high.
• Remediation: A patch is available.

Impact Assessment

The vulnerabilities, while distinct, highlight the ongoing security challenges in foundational software components. The NFSD DoS vulnerability is particularly concerning for organizations that rely on NFS for critical operations, as it could lead to significant downtime. While a DoS is less severe than a remote code execution flaw, it can still have a major business impact. CVE-2026-17434 in NanoClaw is a classic authorization bypass flaw that could allow an attacker to escalate privileges or access restricted data, depending on the application's context. The high complexity of the hermes-agent flaw may limit its immediate risk, but it still represents a weakness that could be chained with other vulnerabilities.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:
| Type | Value | Description |
|---|---|---|
| process_name | nfsd | High CPU utilization by the nfsd process on a Linux server could be an indicator of the infinite loop DoS condition. |
| log_source | dmesg or /var/log/messages | Look for kernel-level error messages or warnings related to NFSD or state revocation failures. |
| other | dpkg -l or rpm -qa | Use package managers to query for installed versions of nanocoai or hermes-agent to identify vulnerable systems. |

Detection Methods

1. Vulnerability Scanning: Use a vulnerability scanner configured with up-to-date plugins to scan your environment for the specific CVEs and vulnerable software versions mentioned.
2. System Monitoring: Monitor CPU usage on NFS servers. A sustained 100% CPU load on a single core by an nfsd process is a strong indicator of the DoS attack.
3. Log Analysis: Ingest kernel and application logs into a SIEM. Create alerts for repeated error messages related to the affected components. For CVE-2026-17434, look for unexpected or malformed requests to the handleAddMcpServer function in application logs.

Remediation Steps

1. Patch Prioritization: Prioritize patching based on exposure and criticality. The Linux kernel NFSD flaw should be prioritized on all internet-facing or critical internal NFS servers.
2. Apply Updates: Follow the guidance from your Linux distribution vendor to apply the necessary kernel updates. For NanoClaw and hermes-agent, update to the patched versions as specified by the project maintainers.
3. Implement Compensating Controls: If patching is not immediately possible for the NFSD flaw, consider temporarily restricting access to the NFS server or implementing rate-limiting to reduce the impact of a potential DoS attack. This is a form of M1035 - Limit Access to Resource Over Network.