EUVD-2026-0010

Use After Free vulnerability was discovered in fs/vfs/fsrename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in...

CVE-2025-48769 Apache NuttX RTOS: fs/vfs/fs_rename: use after free

Use After Free vulnerability was discovered in fs/vfs/fsrename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in...

CVE-2025-48769

CVE-2025-48769 affects Apache NuttX RTOS. The flaw is a Use-After-Free in the fs/vfs/fs_rename code caused by a recursive implementation reusing a single buffer across two pointers, enabling arbitrary user-provided buffer reallocations and writes to a freed heap chunk. In affected scenarios, this...

PT-2025-54474

Name of the Vulnerable Software and Affected Versions Apache NuttX RTOS versions 7.20 through 12.10 Description A Use After Free issue was identified in the fs/vfs/fs rename code of the Apache NuttX RTOS. The issue stems from a recursive implementation and the use of a single buffer by two...

CVE-2025-40351

CVE-2025-40351: In the Linux kernel, the hfsplus code fix addresses a KMSAN uninit-value issue in hfsplus_delete_cat(), triggered during directory creation and mounting paths (as shown by the syzbot trace for hfsplus_subfolders_dec and related calls). The description indicates the issue being res...

EUVD-2025-36973

In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls openbyhandleat on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfsdecodefhraw will then try to conne...

CVE-2017-20203

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

EUVD-1999-1466

Malware in sbrugna...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986615)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986615 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've...

UBUNTU-CVE-2023-53381

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4sscumountitem The reference count of nfsd4sscumountitem is not decremented on error conditions. This prevents the laundromat from unmounting the vfsmount of the source file. This patch...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from improper VF handling during namespace deletion, which could lead to a null pointer dereference...

CVE-2025-38663

CVE-2025-38617 (nilfs2 issue) : In the Linux kernel, a vulnerability was fixed in the NILFS2 file system related to reading inodes from a block device. The root cause was a missing sanity check for the inode file type; if an inode with an invalid file type is encountered, the kernel now treats it...

UBUNTU-CVE-2024-57804

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...

vfs: fix race between evice_inodes() and find_inode()&iput()

...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use CVE-2024-26921 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump...

DEBIAN-CVE-2024-8946

A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mpvfsumount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit...

SUSE CVE-2021-47375

In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blktrace access after removing by sysfs There is an use-after-free problem triggered by following process: P1sda P2sdb echo 0 /sys/block/sdb/trace/enable blktraceremovequeue synchronizercu blktracefree...

flatpak: Sandbox bypass via recent VFS-manipulating syscalls

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the...

DEBIAN-CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

UBUNTU-CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...