CVE-2026-90042

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-90042

CVE-2026-90042 affects the Linux kernel's Ceph filesystem client . The root cause is that the messenger client uses kvmalloc() to allocate message buffers, which can place them in the vmalloc() region when physical memory fragmentation prevents a sufficiently large kmalloc(). The fscrypt subsyste...

EUVD-2026-80650

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-90042 ceph: properly decrypt filenames in vmalloc() buffers

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-89953

CVE-2026-89953 is a memory leak in the Linux kernel's mtdoops module. The root cause is that mtdoops_notify_remove() detaches from the backing MTD device but leaves the oops_page_used bitmap allocated. When the same MTD device is subsequently re-registered, the add path allocates a new bitmap and...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: rcu: Dump vmalloc memory info safely Currently, for double invoke callrcu, the memory information of rcuhead objects will be dumped. If these objects are not allocated from the slab allocator, vmallocdumpobj will be invoked, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: acpi: nfit: Out-of-bounds read in acpinfitCTL. Fixed an issue detected by syzbot with KASAN: - BUG: KASAN: Out-of-bounds access using vmalloc in cmdtofunc, drivers/acpi/nfit/core.c:416 inline. - BUG: KASAN: Out-of-bounds acces...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: intelth: msu: Fix for vmalloced buffers After committing the change f5ff79fddf0e “dma-mapping: remove CONFIGDMAREMAP”, there is a possibility that DMA buffers may be allocated using vmalloc, which can affect the MMAP mapping code...

CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

DEBIAN-CVE-2026-89720

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...

DEBIAN-CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

EUVD-2026-76602

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690

CVE-2026-89690 is a use-after-free in the nfsd (NFS server daemon) component of the Linux kernel. The rpc_status netlink dumpit reads operation numbers from args->ops[] under rcu_read_lock, but that vmalloc buffer is freed synchronously via vfree() in nfsd4_release_compoundargs() without being...

CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

PT-2026-90406

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc status UAF The rpc status netlink dumpit walks every in-flight svc rqst under rcu read lock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc...

AZL-99555 CVE-2026-80892 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig preallocates one...

CVE-2026-80892

CVE-2026-80892 affects the Linux kernel's EROFS filesystem driver (fs/erofs/decompressor_lzma.c). When the lzma_streams module parameter is unset, the global MicroLZMA stream pool is sized from num_possible_cpus() , and each stream preallocates an image-supplied dictionary of up to 8 MiB . On hig...