CVE-2026-43053

A flaw was found in the Linux kernel's XFS filesystem. During the inactivation of inodes with extended attributes, a specific timing window exists where a log shutdown can occur after some data blocks are invalidated but before the attribute map is fully truncated. This can lead to inconsistencie...

CVE-2026-31556

A flaw was found in the Linux kernel's XFS filesystem component. During quota scrubbing, the xchkquotaitem function could exit prematurely without releasing a critical lock. This can result in lock leaks or deadlocks in subsequent quota operations, potentially leading to system instability or a...

CVE-2026-31556

In the Linux kernel, the following vulnerability has been resolved: xfs: scrub: unlock dquot before early return in quota scrub xchkquotaitem can return early after calling xchkfblockprocesserror. When that helper returns false, the function returned immediately without dropping dq-qqlock, which...

CVE-2026-31455

A flaw was found in the Linux kernel's XFS file system. During the unmount process, the system attempts to flush data while background cleanup and inode garbage collection inodegc operations are still active. This improper synchronization can lead to data integrity issues or system instability, a...

CVE-2026-31453

A flaw was found in the Linux kernel's XFS filesystem. This vulnerability arises when log items are accessed after their memory has been freed, specifically during certain push callbacks if the Allocation Information List AIL lock is released. This memory corruption can lead to a system crash,...

CVE-2026-31454 xfs: save ailp before dropping the AIL lock in push callbacks

In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfsinodeitempush and xfsqmdquotlogitempush, the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the...

USN-8177-1 linux, linux-realtime vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

CVE-2026-23251

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

CVE-2026-23252 xfs: get rid of the xchk_xfile_*_descr calls

In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchkxfiledescr calls The xchkxfiledescr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes or whatever the nofail guarantees are nowadays. Some of them cou...

CVE-2026-23252

In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchkxfiledescr calls The xchkxfiledescr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes or whatever the nofail guarantees are nowadays. Some of them cou...

CVE-2026-23252

The CVE-2026-23252 issue affects the Linux kernel XFS code. The root cause is the xchk_xfile_*_descr macros calling kasprintf, which could fail to allocate memory when formatting strings larger than the non‑no-fail limit. The patch removes this path by passing static strings instead, eliminating ...

CVE-2026-23251 xfs: only call xf{array,blob}_destroy if we have a valid pointer

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

CVE-2026-23251 xfs: only call xf{array,blob}_destroy if we have a valid pointer

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21667)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21667 advisory. - In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004173 advisory. A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001533 advisory. A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files for the XFS file-system with an...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004233)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004233 advisory. A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001214)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001214 advisory. In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001089)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001089 advisory. Multiple memory leaks in error paths in fs/xfs/xfsattrlist.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service memory consumption via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001620)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001620 advisory. An issue was discovered in fs/xfs/xfssuper.c in the Linux kernel before 4.18. A use after free exists, related to xfsfsfillsuper failure. Tenable has extracted the...