EUVD-2026-76562

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89650

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89650

CVE-2026-89650 is a slab-out-of-bounds read in the Linux kernel's CephFS client , specifically in ceph_mdsmap_decode() (fs/ceph/mdsmap.c). When decoding an MDS map with per-MDS info version 2 or 3, the function advances the decode cursor by num_export_targets * sizeof(u32) without verifying remai...

EUVD-2026-76556

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89644

CVE-2026-89644 affects the btrfs filesystem in the Linux kernel. The root cause is an extent map reference leak in the NOCOW direct I/O write path: btrfs_get_blocks_direct_write() fails to drop the extent map obtained from btrfs_get_extent() when btrfs_create_dio_extent() returns an error (e.g., ...

CVE-2026-89644

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89644 btrfs: fix extent map leak in NOCOW direct I/O write

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89644 btrfs: fix extent map leak in NOCOW direct I/O write

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-67211

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

CVE-2026-67211

Apache OpenNLP versions 3.0.0-M4 and 3.0.0-M5 are vulnerable to a Denial of Service via an OutOfMemoryError in the SymSpellModelSerializer . The create() method fails to apply an upper bound to the unigramCount and bigramCount fields read from a binary SymSpell model stream, allowing an attacker ...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

CVE-2026-89650: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

PT-2026-90366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the CephFS client kernel when processing CEPH MSG MDS MAP messages. The function ceph mdsmap decode in fs/ceph/mdsmap.c reads the num export targets...

CVE-2026-50013: Concurrent Execution using Shared Resource with Improper Synchronization

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

PT-2026-96564

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check new map on session freed during unlock check new map iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107266 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in readonechunk Store the error...

PT-2026-96511

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfs dio iomap begin calls btrfs get extent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range, btrfs get bloc...

CVE-2026-89644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

PT-2026-96414

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi alloc sgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dma map sg attrs+0x217/0x310 dma map sg attrs+0x217/0x310 dma map sg attrs+0x4a/0x7...