USN-8705-2: OpenZFS vulnerability

USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker...

USN-8705-2 zfs-linux vulnerability

USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker...

CVE-2026-82346

A potential privilege escalation vulnerability was identified in HP ImageDiags , affecting versions prior to 5.0.0.36 . The root cause is insufficient access controls , which could allow a local attacker with low privileges and active user interaction to escalate to higher system access. The assi...

CVE-2026-82797

A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service DoS by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data. Mitigation Update...

CVE-2026-80651

A flaw was found in the Linux kernel's crypto: ccp/sev-dev-tsm module. The dsmcreate function fails to properly validate the pdev-bus pointer, leading to a null pointer dereference. A local attacker could exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service DoS...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

CVE-2026-80627

A flaw was found in the Linux kernel, specifically within the MIPS architecture's memory management component. The maarreswalk function performs an out-of-bounds write when processing memory ranges. This occurs because the function fails to check if its internal array is full before writing new...

CVE-2026-80623

A flaw was found in the Coresight Embedded Trace Extension ETE component of the Linux kernel. This vulnerability arises because the system register states for Embedded Trace Macrocells ETMs and ETE are not consistently preserved when the CPU powers down. A local attacker could potentially trigger...

CVE-2026-80601

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module of the Linux kernel. When the pskbmaypull function is called by batadvgetvid, it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

CVE-2026-66141

A flaw was found in Exim. This vulnerability allows a local attacker to achieve privilege escalation due to the mishandling of forcecommand for a pipe transport when processing .forward files. This could enable an unprivileged user to gain elevated access on the system. Mitigation Upgrade to Exim...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

CVE-2026-80710

A flaw was found in the Linux kernel's s390/dasd component. An integer truncation vulnerability in the dasdeckdcheckdeviceformat function can lead to an undersized buffer allocation. This allows a local attacker to write past the end of the allocated buffer, potentially causing memory corruption...

hdf5: HDF5: Denial of Service via crafted file requiring user interaction

A flaw was found in HDF5, a data management library. This vulnerability, a heap-based buffer overflow, allows a local attacker to cause a denial of service DoS by persuading a user to open a specially crafted HDF5 file. The malformed file can trigger out-of-bounds memory operations, leading to...

USN-8705-1 zfs-linux vulnerability

It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass...

USN-8692-1: GNU diffutils vulnerability

It was discovered that GNU diffutils incorrectly handled certain integer arithmetic when mapping line ranges in diff3. A local attacker could possibly use this issue to cause diff3 to crash, resulting in a denial of service...

dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

USN-8691-1: attr vulnerability

It was discovered that attr incorrectly handled symbolic links while traversing directory paths. A local attacker who controlled a pathname component could possibly use this issue to redirect privileged attr operations to arbitrary files and gain elevated privileges...

USN-8691-1 attr vulnerability

It was discovered that attr incorrectly handled symbolic links while traversing directory paths. A local attacker who controlled a pathname component could possibly use this issue to redirect privileged attr operations to arbitrary files and gain elevated privileges...

CVE-2026-80636

A flaw was found in the Netfilter conntrack component of the Linux kernel. This vulnerability arises from the improper handling of connection tracking conntrack extensions. Specifically, a codebase change that disables all conntrack extensions for unconfirmed conntracks, without proper null check...