EUVD-2026-91137

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create...

CVE-2026-103765

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create...

CVE-2026-103765

Mooncake versions through 0.3.13.post1 are affected by a missing authentication vulnerability in the HTTP metadata server /metadata handler . This flaw allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Specifically, attackers can poison segment descrip...

K000163351: Linux kernel vulnerabilities CVE-2026-45852 and CVE-2026-53391

Security Advisory Description CVE-2026-45852 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxesrqfrominit In rxesrqfrominit, the queue pointer 'q' is assigned to 'srq-rq.queue' before copying the SRQ number to user space. If copytouser fails, the...

Linux Distros Unpatched Vulnerability : CVE-2026-89649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name...

CVE-2026-89649

A flaw was found in the Linux kernel's Ceph file system CephFS component. A malicious or compromised metadata server can manipulate the length of an extended attribute xattr value, causing the system to read beyond the intended memory boundary. This out-of-bounds read allows a local user to acces...

CVE-2026-89648

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server MDS could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an infinite loop or exhaust memory resources, leading to a denia...

DEBIAN-CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649

This out-of-bounds read affects the Linux kernel's CephFS client , specifically the __build_xattrs() function. When decoding the xattr blob supplied by a Ceph metadata server (MDS), the 32-bit value length of the final attribute is never validated against the blob size via a ceph_decode_need() ch...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-90365

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel within the Ceph component where the build xattrs function fails to properly validate the length of the final attribute in an xattr blob supplied by th...

PT-2026-90364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's Ceph implementation where the ceph parse deleg inos function fails to validate the value of the len variable when decoding interval sets of delegate...

kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

UBUNTU-CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

CVE-2026-43420 ceph: fix i_nlink underrun during async unlink

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...