3627 matches found
CVE-2026-45935: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'doaction' function, the entry size 'esize' is retrieved from the log record without adequate bounds checking. Specifically,...
CVE-2026-45864: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing valid within the range valid : pos, if valid cannot be retrieved correctly, for example, if the retrieved valid value is always the same, th...
CVE-2026-46100: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fs: afs: revert mmapprepare change Partially reverts commit 9d5403b1036c "fs: convert most other genericfilemmap users to .mmapprepare". This is because the .mmap invocation establishes a refcount, but .mmapprepare is called at a...
CVE-2025-71311: Use of Uninitialized Resource
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longestmatchstd, invoked from ntfscompresswrite. When new folios are allocated without being marked uptodate and nireadframe is skipped because th...
CVE-2025-71312: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix ntfsmountoptions leak in ntfsfillsuper In ntfsfillsuper, the fc-fsprivate pointer is set to NULL without first freeing the memory it points to. This causes the subsequent call to ntfsfsfree to skip freeing the...
CVE-2026-45920: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4putsuper associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324...
CVE-2026-41917
OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ipc: mqueue: fixed a possible memory leak in initmqueuefs The commit details are as follows: db7cfc380900 "ipc: Free mqsysctls if ipc namespace creation failed" This is a similar memory leak to the one fixed by the above patch. A...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: fs/dax: Fixed the issue of “not skipping locked entries when scanning entries”. The commit 6be3e21d25ca “fs/dax: not skipping locked entries when scanning entries” introduced a new function, waitentryunlockedexclusive, which wait...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ipc: A memory leak has been fixed in initmqueuefs. When setupmqsysctls failed in initmqueuefs, the mqueue inode cachep is not released. To address this issue, the release path has been reordered...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iouring: Fixed a fget leak when the file system does not support nowait buffered reads. Heming reported a bug when using iouring for link-cp operations on ocfs2. 1 The following steps can reproduce this bug: mount -t ocfs2 /dev/v...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: bcachefs: kvfree bchfs::snapshots in bch2fssnapshotsexit. bchfs::snapshots is allocated by kvzalloc in snapshottmut. It should be freed by kvfree, not kfree. Otherwise, umount will trigger an error: 406.829178 BUG: Unable to...
WS-2021-0522
In Linux/Kernel is vulnerable to use-after-free due to missing POLLFREE handling in fs/aio.c...
WS-2021-0517
In Linux/Kernel is vulnerable to user buffer by properly using clearuser in fs/proc/vmcore.c. The fix versions are v4.4.294, v4.9.292, v4.14.258, v4.19.219, v5.4.163, v5.10.83, v5.15.6, v5.16-rc3...
WS-2021-0476
In Linux/Kernel is vulnerable to mount fails with buffer overflow in strlen in fs/ocfs2/super.c...
WS-2018-0110
All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in...
CVE-2026-34962
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4common.c where the ext4fsiteratedir function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a...
CVE-2026-34961
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the ehentries field against buffer capacity in fs/ext4/ext4common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigg...
CVE-2026-34961: Out-of-bounds Read
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the ehentries field against buffer capacity in fs/ext4/ext4common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigg...
CVE-2026-34962: Loop with Unreachable Exit Condition
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4common.c where the ext4fsiteratedir function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a...