UBUNTU-CVE-2026-72379

In the Linux kernel, the following vulnerability has been resolved: fs: refuse OTMPFILE creation with an unmapped fsuid or fsgid vfstmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the -tmpfi...

UBUNTU-CVE-2026-74307

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

CVE-2026-74307 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

CVE-2026-74307 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

EUVD-2026-59454

In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4IOCMOVEEXT Reject the EXT4IOCMOVEEXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside...

PT-2026-72567

In the Linux kernel, the following vulnerability has been resolved: fs: refuse O TMPFILE creation with an unmapped fsuid or fsgid vfs tmpfile never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fsu,gid, the...

PT-2026-72936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A denial of service DoS issue exists in the binfmt misc module. An entry registered with the 'F' flag opens its interpreter at registration and retains the file until the entry is freed...

GO-2023-2412 vulnerabilities

Vulnerabilities for packages: grype, helm-push, skaffold, flux-helm-controller, flux-source-controller, helm, cilium-cli, kaniko, kots, melange, kubescape, ctop, up, k3d, kubevela, zot, trivy, fuse-overlayfs-snapshotter, gitness, k8sgpt, newrelic-infrastructure-agent, eksctl, buildkitd...

GO-2026-4440 vulnerabilities

Vulnerabilities for packages: etcd-fips, gendesk, rke2-runtime, runc, k8s-device-plugin, rke2-runtime-fips, localstack, cilium-envoy-fips, backup-restore-operator, kube-conformance, cilium-envoy, aws-load-balancer-controller, k3s, etcd, fuse-overlayfs-snapshotter, gitness, terraform, wuzz,...

GO-2026-4441 vulnerabilities

Vulnerabilities for packages: etcd-fips, gendesk, rke2-runtime, runc, k8s-device-plugin, rke2-runtime-fips, localstack, cilium-envoy-fips, backup-restore-operator, kube-conformance, cilium-envoy, aws-load-balancer-controller, k3s, etcd, fuse-overlayfs-snapshotter, gitness, terraform, wuzz,...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: beats-fips, rke2-runtime, rke2-runtime-fips, datadog-agent, elastic-agent, frankenphp-8.2, commercial-expanso-edge, beats, consul, datadog-agent-fips, mattermost, frankenphp-8.3, frankenphp-8.4, kine, grafana-fips, k3s, frankenphp-8.5, zot, containerd, loki,...

GO-2026-5942 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller-fips, opentelemetry-collector-contrib, livekit-server-fips, terragrunt, dcgm-exporter-fips, prometheus-operator, image-factory, kiali-fips, versitygw-fips, helm-operator-fips, tflint-fips, spilo, syncthing-fips, spicedb-operator-fips,...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: k3s, containerd, fuse-overlayfs-snapshotter, kine, zot, loki...

GO-2023-2412 vulnerabilities

Vulnerabilities for packages: skaffold, flux-helm-controller, grype, melange, kubevela, kaniko, k3d, helm, up, eksctl, trivy, fuse-overlayfs-snapshotter, flux-source-controller, k8sgpt, cilium-cli, zot, gitness, helm-push, kubescape, kots, ctop, buildkitd, newrelic-infrastructure-agent...

GO-2026-4440 vulnerabilities

Vulnerabilities for packages: k3s, aws-load-balancer-controller, k8s-device-plugin, fuse-overlayfs-snapshotter, runc, wuzz, gitness...

GO-2026-4441 vulnerabilities

Vulnerabilities for packages: k3s, aws-load-balancer-controller, k8s-device-plugin, fuse-overlayfs-snapshotter, runc, wuzz, gitness...

CVE-2026-68448

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read file...

AZL-95513 CVE-2026-68448 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

DEBIAN-CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...