GHSA-98Q5-5QH2-7W75 Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

Vulnerability SearchFirstActiveDirectoryRealm.findUserDn substitutes the user-supplied username from the login form into an LDAP search filter template default cn=0 without escaping RFC 4515 filter metacharacters , , , , NUL. Combined with SearchControls.setCountLimit1 on the same call site, this...

DEBIAN-CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

AZL-100625 CVE-2026-89615 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

AZL-100271 CVE-2026-89617 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

DEBIAN-CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

DEBIAN-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

DEBIAN-CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

AZL-100467 CVE-2026-89444 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

UBUNTU-CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

UBUNTU-CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

UBUNTU-CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

UBUNTU-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

CVE-2026-89617

A vulnerability in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) allows a local attacker to craft a malicious NTFS log file where a tampered lcns_follow field in a DIR_PAGE_ENTRY causes an out-of-bounds write during log replay. The root cause is that check_rstbl() validates table bookkeepin...