sysctl and platform-op locks open to abuse

ISSUE DESCRIPTION To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any...

CVE-2026-12124

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

SUSE CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

UBUNTU-CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64398

CVE-2026-64398 affects the Linux kernel ksmbd component. A permission check bypass in FSCTL_SET_ZERO_DATA allows an authenticated SMB client with only FILE_WRITE_ATTRIBUTES to zero out file data via fsctl path, bypassing per-handle checks. The operation uses vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) a...

CVE-2026-64398 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

EUVD-2026-48942

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64398 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64394 ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

PT-2026-64619

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc7 Description An authenticated SMB client can bypass permission checks in the ksmbd module. The smb2 ioctl function fails to perform a per-handle access check when processing FSCTL SET ZERO DATA, relying on...

CVE-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-65011

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

EUVD-2026-47743

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...

CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...