UBUNTU-CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

Fuse-overlayfs (overlayfs in FUSE for rootless containers) before version 1.17 on the release-1.x C branch preserves SUID/SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file. This may allow a low-privilege process to leave the upper-layer file with mode 4777. T...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

Linux Distros Unpatched Vulnerability : CVE-2026-52791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in...

CVE-2026-52791: Incorrect Privilege Assignment

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

PT-2026-65846

Name of the Vulnerable Software and Affected Versions fuse-overlayfs versions prior to 1.17 Description In the release-1.x C branch, the software preserves SUID Set User ID and SGID Set Group ID mode bits in the main.c file during openO TRUNC and truncate handling on a copied-up file. This behavi...

container-tools:ol8 security, bug fix, and enhancement update

aardvark-dns 2:1.10.1-2 - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah 2:1.33.14-3 - rebuild for CVE-2025-68121 - Resolves: RHEL-149262 cockpit-podman 84.1-1 - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 - Related: Jira:RHEL-25557 conmon...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: chartmuseum, kube-arangodb, steampipe, opa-envoy, kots, spegel, xeol, tigera-operator, trivy-operator, trivy, gatekeeper, k8ssandra-client, rancher-helm, dagger, datadog-agent, kaniko, manifest-tool, docker-cli-buildx, helm-operator, wolfictl, teleport, k9s, linkerd2...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: trivy-operator, helm-exporter, xeol-fips, opa-fips-envoy, kgateway, headlamp-fips, upwind-agent, docker, skaffold-fips, docker-cli-buildx, syft, helm-exporter-fips, kubescape-server-fips, k9s, opa, helm, linkerd2, envoy-gateway, syft-fips, k8ssandra-client,...

SUSE CVE-2026-31465

In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarantees Add a SBINODATAINTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync eg fuse. For superblocks with this flag set, sy...

EUVD-2026-24809

In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarantees Add a SBINODATAINTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync eg fuse. For superblocks with this flag set, sy...

CVE-2026-31465

CVE-2026-31465 in the Linux kernel concerns the writeback path for filesystems without data integrity guarantees (e.g., fuse). The fix adds a SB_I_NO_DATA_INTEGRITY superblock flag; when set, sync kicks off writeback of dirty inodes but does not wait for flusher threads to finish. The change move...

PT-2026-34370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the writeback mechanism where the system blocks sync for filesystems that cannot guarantee data persistence, such as fuse. This occurs because the system waits for...

CVE-2026-31465: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarantees Add a SBINODATAINTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync eg fuse. For superblocks with this flag set, sy...

GHSA-W4GW-W5JQ-G9JH vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, wuzz, k3s, runc, aws-load-balancer-controller, fuse-overlayfs-snapshotter, gitness...

GHSA-W4GW-W5JQ-G9JH vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, cilium-envoy, terraform, kube-conformance, localstack, cilium-envoy-fips, etcd, backup-restore-operator, fuse-overlayfs-snapshotter, rke2-runtime, rke2-runtime-fips, gendesk, wuzz, runc, gitness, gitlab-rails-ce, etcd-fips, k3s,...