EUVD-2026-55554

In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...

CVE-2026-68167 btrfs: do not try compression for data reloc inodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...

EUVD-2026-55551

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68165

The CVE affects the Linux kernel DAMON subsystem (mm/damon/core) where damon_set_regions() did not validate zero-length regions created by certain callers (DAMON_SYSFS, DAMON_RECLAIM, DAMON_LRU_SORT). This could trigger WARN_ONCE on CONFIG_DAMON_DEBUG_SANITY and cause a divide-by-zero in damon_me...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

EUVD-2026-55550

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68155

CVE-2026-68155 affects the Linux kernel libceph component. A crafted monmap advertising zero monitors can be treated as valid, potentially crashing the client when opening a session (DoS) due to BUG_ON(monc->monmap->num_mon

EUVD-2026-55541

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154

The CVE-2026-68154 vulnerability affects the Linux kernel’s libceph component, where CRUSH map decoding accepts bucket type 0 (reserved for devices) can let a malformed map cause a negative bucket ID to index the OSD weight array, leading to denial of service. The issue is fixed by rejecting zero...

EUVD-2026-55540

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

EUVD-2026-55529

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145

CVE-2026-68145 describes a Linux kernel iomap vulnerability where zero-length ranges in ifs_set_range_dirty() and ifs_set_range_uptodate() cause an unsigned underflow in (off + len - 1) >> i_blkbits, producing a huge last_blk and nr_blks and leading to out-of-bounds bitmap_set() writes. A f...

CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

EUVD-2026-55512

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...