942 matches found
UBUNTU-CVE-2026-93786
In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...
EUVD-2026-86038
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...
CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...
PT-2026-98012
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ksmbd module within the ksmbd vfs set sd xattr function. The ndr encode v4 ntacl function allocates memory for sd ndr.data using kzalloc. If a subsequent ndr...
PT-2026-104978
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix sd ndr.data memory leak in ksmbd vfs set sd xattr ndr encode v4 ntacl allocates sd ndr.data via kzalloc at entry. If any subsequent ndr write call returns error during encoding, the allocated sd ndr.data won't be freed...
PT-2026-104955
In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...
PT-2026-97986
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the Virtual File System VFS initializes a child's POSIX Access Control List ACL using the parent's default ACL and the requested creation mode...
PT-2026-97945
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 module where the make bad inode function is used within ocfs2 read inode block full. Because make bad inode resets the inode type to S IFREG, applying this t...
CVE-2026-93786
In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...
com.github.junrar:commons-vfs-rar (1.0.0) potentially affected by CVE-2026-86071 via com.github.junrar:junrar (5.0.0)
com.github.junrar:junrar MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.junrar:junrar and may be impacted: - com.github.junrar:commons-vfs-rar 1.0.0 Source cves: CVE-2026-86071 Source advisory: OSV:GHSA-89M4-43J5-VHHX...
CVE-2026-90155: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: vfs: fixed a race condition between eviceinodes and findinode&iput Hi, everyone, I recently noticed a bug in btrfs. After investigating it further, I believe it’s a race condition in vfs. Let’s assume that an inode in this case,...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba, specifically in the vfsstreamsxattr module. In this module, uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content, which may include sensitive data, resulting in an information...
Astra Linux – Vulnerability in Qemu
A issue was discovered in QEMU versions 7.1.0 through 8.2.1. The registervfs function in hw/pci/pciesriov.c mishandles the situation where a guest writes a number of NumVFs that is greater than the total number of TotalVFs, resulting in a buffer overflow in VF implementations...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
In the Linux kernel, the following vulnerability has been resolved: ocfs2: Avoid touching a renamed directory if its parent does not change. The VFS will not lock the moved directory if its parent does not change. Modify the ocfs2 rename code to avoid touching the renamed directory if its parent...
CVE-2026-89672
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...
GHSA-C476-6W5Q-JW77 rclone: FTP cross-session auth-proxy backend confusion
Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...
kernel: Revert "net/smc: Introduce TCP ULP support"
A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...
PT-2026-89689
Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...
