812 matches found
DEBIAN-CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
AZL-100142 CVE-2026-89713 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
UBUNTU-CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713
A TOCTOU race condition in the Linux kernel's NFS Daemon (NFSD) component allows a remote, unauthenticated attacker to bypass append-only file protections. In nfsd_setattr(), the NFSD_MAY_TRUNC permission check samples the file size without holding inode_lock(), but the actual size update is appl...
CVE-2026-89713 NFSD: check truncate permission under inode lock
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
EUVD-2026-76625
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713 NFSD: check truncate permission under inode lock
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
PT-2026-90429
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the nfsd setattr function. The function checks if a size update requires NFSD MAY TRUNC permissions using a file size sampl...
CVE-2026-89713: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
PT-2026-96355
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...
GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names
Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...
CVE-2026-80898
In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...
CVE-2026-80898
In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...
EUVD-2026-71648
In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...
CVE-2026-80898
CVE-2026-80898 affects the Linux kernel netfs subsystem. In netfs_pgpriv2_copy_to_cache(), a folio is marked with PG_private_2 before being appended to the copy-to-cache rolling buffer by netfs_pgpriv2_copy_folio(). If the append fails, the folio is not queued for cache writeback, yet the PG_priv...
CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...
CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...