CVE-2026-72189

CVE-2026-72189 concerns the Linux kernel ntfs attribute-list update path. When the superblock becomes inactive, generic_shutdown_super() clears SB_ACTIVE and eviction of inodes can cause the fake inode for a base inode’s unnamed $ATTRIBUTE_LIST to be referenced in a way that leads to a self-deadl...

CVE-2026-72185 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

EUVD-2026-58943

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-72185

The CVE-2026-72185 entries describe a Linux kernel NTFS vulnerability in ntfs_map_runlist_nolock() where a crafted NTFS image could place a resident attribute where a non-resident attribute is expected. The underlying bug was a mismatch between expected attribute type and actual data, previously ...

CVE-2026-72185 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-73050: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-72207: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

CVE-2026-72198: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

CVE-2026-72185: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-72200: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

PT-2026-72395

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs resident attr resize function may incorrectly convert zero-length resident $DATA attributes to non-resident attributes when attempting t...

PT-2026-72373

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARN ON for resident attribute in ntfs map runlist nolock When ntfs map runlist nolock needs to look up the attribute extent containing a target VCN ctx needs reset == true, it calls ntfs attr lookup and then expects th...

PT-2026-72397

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfs attr find and ntfs external attr find check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For...

PT-2026-72386

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the shared lookup-time attribute validator fails to reject non-resident records for certain resident-only attribute types. This creates...

CVE-2026-73047: Exposure of Sensitive Information to an Unauthorized Actor

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

PT-2026-73051

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...

PT-2026-73055

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handle...

PT-2026-72377

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...

PT-2026-72387

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where resident $INDEX ROOT values are not fully validated during lookup. The index header fields, which are consumed by callers after lookup, lacked...

Linux Distros Unpatched Vulnerability : CVE-2026-72198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records...