64675 matches found
DEBIAN-CVE-2026-89689
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...
CVE-2026-89689
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...
DEBIAN-CVE-2026-89654
In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...
DEBIAN-CVE-2026-89650
In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...
AZL-100770 CVE-2026-89654 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...
DEBIAN-CVE-2026-89651
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89654
In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...
CVE-2026-89635
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
DEBIAN-CVE-2026-89569
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...
DEBIAN-CVE-2026-80996
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
CVE-2026-80996
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
UBUNTU-CVE-2026-89641
In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfoput in cifsfilesetsize When the else branch of cifsfilesetsize finds a writable file handle via findwritablefile, it borrows tcon and server from the handle's tlink, attempts the handle-based...
UBUNTU-CVE-2026-89635
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
CVE-2026-89708
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...
CVE-2026-89635
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
UBUNTU-CVE-2026-89569
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...
UBUNTU-CVE-2026-89689
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...
CVE-2026-89689
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4sequence can free the very slot it is currently processing. When the session shrinker has reduced setargetmaxslots below sefchannel.maxreqs, the shrink path checks three...
UBUNTU-CVE-2026-89708
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...