CVE-2026-89772

A flaw was found in the Btrfs filesystem of the Linux kernel. This vulnerability allows a local attacker with write access to a memory-mapped file to modify data while it is being written to disk. This can lead to data corruption, where the integrity of the stored information is compromised, or...

CVE-2026-89772

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

EUVD-2026-76684

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89772

CVE-2026-89772 affects the btrfs filesystem in the Linux kernel . A patch (commit 095be159f3eb) replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check, losing the write-protection of shared mmap PTEs during data writeback. Without this pro...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-34949

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

CVE-2026-34949

Combodo iTop versions prior to 3.2.3 are affected by an unauthenticated file deletion vulnerability. An attacker with no credentials can delete the .readonly file, which is created during the setup process to prevent users from performing write actions. Removing this file effectively disables the...

CVE-2026-72180

A flaw was found in the Linux kernel's huge memory management mm/hugememory. When a device-private Page Middle Directory PMD is downgraded, the pmdswpuffdwp bit, which indicates Userfault File Descriptor Write Protect UFFDWP, is not properly preserved. This oversight allows a local attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-72180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable o...

CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72186

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

UBUNTU-CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72186

CVE-2026-72186 affects the Linux kernel NTFS handling: system files such as $Bitmap exposed via show_sys_files can be written from userspace, causing volume corruption and a deadlock between writeback and the folio due to the cluster allocator scanning the inode’s page cache. The fixed approach m...

CVE-2026-72186 ntfs: make system files immutable to prevent corruption

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

CVE-2026-72186 ntfs: make system files immutable to prevent corruption

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

CVE-2026-72180 mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72175

CVE-2026-72175修复针对 Linux 内核 fs/proc/task_mmu 中的 make_uffd_wp_huge_pte() 的 prot-update race。六项变更来自 patch series “userfaultfd/pagemap: pre-existing fixes”，用于 present 的 HugeTLB PTE 上状态更新时的时序竞态：在未调用对应的 ptep_modify_prot_start() 的情况下就执行 ptep_modify_prot_commit()，可能导致写入了过时的快照。修复通过对 present-PTE 分支采用与非 hu...

EUVD-2026-59001

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in pte,pmdwrprotect When hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGEDIRTY directly in the page table entry during a write TLB miss, without going through...

btrfs: do not trim a device which is not writeable

...

EUVD-2026-45237

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...