Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.19. It stems from insufficient loop checks on mount namespaces when performing recursive bind mounts; this may result in copying file descriptors from other mount namespaces, leading to mount namespace leaks and memory consumption...

PT-2026-121961

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dont mount on the victim and then detach mounts with the victim's inode locked. do lock mount takes the inode lock of the mountpoint an...

Linux Distros Unpatched Vulnerability : CVE-2026-98989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's ...

Security Bulletin: Vulnerability in BIND (CVE-2025-13878) affects AIX/ VIOS.

Summary A remote attacker can send or trigger processing of malformed BRID/HHIT DNS resource records, causing the named daemon to terminate unexpectedly. Vulnerability Details CVEID:CVE-2025-13878 DESCRIPTION: Malformed BRID/HHIT records can cause named to terminate unexpectedly. This issue affec...

CLSA-2026-1792648513 Fix of 13 CVEs

SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records - debian/patches/CVE-2025-8677.patch: fail validation on invalid DNSKEY in lib/dns/validator.c. - CVE-2025-8677 SECURITY UPDATE: cache poisoning through forged records in answers - debian/patches/CVE-2025-40778.patch: tighten resolver...

CLSA-2026-1792630839 bind: Fix of 2 CVEs

CVE-2026-78301: ignore nodes above the zone origin in RBT zone database lookups...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792630839)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792630839 advisory. - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This...

SUSE CVE-2026-19630

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

SUSE CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially...

SUSE CVE-2026-96888

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1...

SUSE CVE-2026-97313

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...

CLSA-2026-1792590954 bind: Fix of 3 CVEs

CVE-2026-19941: require an NSEC wildcard proof to be signed by the same zone as the validated NOQNAME proof - CVE-2026-75029: skip duplicate records of singleton types when parsing a message - CVE-2026-77119: ignore NSEC3 records from zones that do not enclose the DS name when proving an insecure...

CVE-2026-19630

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...

CVE-2026-96888

A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...

CVE-2026-94300

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

CVE-2026-97313

A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...

bind: bind: Denial of Service via assertion failure during redirect processing

A flaw was found in BIND. A remote attacker can cause a Denial of Service DoS by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization whi...

bind: BIND: Denial of Service via unbounded processing of crafted DNS messages

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...

bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

bind: bind: Denial of service via assertion failure in RPZ query processing

A flaw was found in BIND. A remote attacker can cause a denial of service DoS by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones RPZ with differing recursion settings,...