GHSA-7C3P-84R8-H79Q Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard...

CVE-2026-92958

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958

vm2 (a Node.js sandboxing library) versions through 3.11.6 contain a builtin-module denylist bypass in NodeVM . When embedders use the wildcard with negative entries (e.g., -fs), matching is done by exact module name in lib/builtin.js, so fs/promises is not blocked. Sandboxed code can therefore c...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958: Improper Privilege Management

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

PT-2026-94917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ffs dmabuf transfer function within the USB gadget f fs module. In error paths related to endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM, the...

CVE-2026-90200: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-93099: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

CVE-2026-90266: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

CVE-2026-90199: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-93100: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroupknput A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep while waiting on acquiring rdtgroupmutex take a...

PT-2026-94896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fs/resctrl component. The problem occurs due to a race condition between the fallback freer in the rdtgroup kn put function and the primary bulk...

SUSE CVE-2026-89779

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

SUSE CVE-2026-89782

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

AZL-101345 CVE-2026-89785 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

AZL-101265 CVE-2026-89779 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89785

CVE-2026-89785 is an out-of-bounds read in the Linux kernel's NTFS3 filesystem driver. The functions ntfs_reparse_init() and ntfs_objid_init() parse the INDEX_ROOT attributes ($R and $O) of the $Extend/$Reparse and $Extend/$ObjId metafiles using resident_data() , which fails to verify that the re...