Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the iomapreadfolioiter function not properly clearing ctx-curfolio when iblkbits and I/O...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013684)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013684 advisory. In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in putpagebootmem The vmemmap pages is marked by...

CVE-2026-41061

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...

EUVD-2026-24539

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...

CVE-2026-41061 WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...

CVE-2026-41061

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...

CVE-2026-41061 WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...

EUVD-2026-24525

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest, does not verify a CSRF/global token, and does not check...

EUVD-2026-24523

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013162)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013162 advisory. In the Linux kernel, the following vulnerability has been resolved: Revert mmc: dwmmc: Fix IDMAC operation with pages bigger than 4K The commit 8396c793ffdf mmc:...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013358)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013358 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gssfreeintokenpages The intoken-pages array is not NULL...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013365)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013365 advisory. In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata-readintopages When the network status is unstable, use-after-fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011124)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011124 advisory. In the Linux kernel, the following vulnerability has been resolved: ubifs: ubifsreleasepage: Remove ubifsassert0 to valid this process There are two states for ubifs...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013213)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013213 advisory. In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swapinfostruct race between swapoff and getswappages The si-lock must be held when...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011128)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011128 advisory. In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rbmovetail and rbcheckpages It seems a data race between...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013360 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/mm/identmap: Use gbpages only where full GB page should be mapped. When identpudinit uses onl...

FreeBSD-SA-26:11.amd64

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:11.amd64 Security Advisory The FreeBSD Project Topic: Missing large page handling in pmappkruupdaterange Category: core Module: amd64 Announced: 2026-04-21...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-011186)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011186 advisory. In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: don't delete error page from pagecache This change is very similar to the change that...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011263)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011263 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-007007)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007007 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm-lock to fix UAF in svmregisterencregion Do the cache flush of...