CVE-2026-53388

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on entry but does not re-lock it on the success path. This means fusechanabort can end the request and free the fuseioargs eg...

EUVD-2026-45510

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on entry but does not re-lock it on the success path. This means fusechanabort can end the request and free the fuseioargs eg...

CVE-2026-53388

CVE-2026-53388 : Linux kernel fuse module vulnerability where fuse_try_move_folio() unlocks the request on entry but does not re-lock on the success path, allowing a use-after-free of fuse_io_args via fuse_chan_abort() and delayed copying logic. The issue is resolved by calling lock_request() bef...

CVE-2026-16208

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

EUVD-2026-45419

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

CVE-2026-16208

CVE-2026-16208 affects django-tastypie up to 0.15.1. The vulnerability resides in the CacheThrottle/CacheDBThrottle in tastypie/throttle.py, causing a race condition. It is potentially exploitable remotely; attack complexity is described as high. Details on fixes or patches are not provided in th...

PT-2026-61093

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse module. The fuse try move folio function unlocks the request upon entry but fails to re-lock it during the success path. Consequently, fuse chan...

PT-2026-61042

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

PT-2026-61348

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 z erofs fill bio vec ... filemap add folio 1 z erofs bind cache .. .. folio...

PT-2026-61476

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where i size remote i size Fix the update of the zero point by netfs release folio when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio...

PT-2026-61323

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter nf tables component where destination corruption occurs during same register operations. For lshift and rshift operations, the system performs shifts in ...

PT-2026-61374

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs get link The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afs read single to prevent races betwe...

PT-2026-61450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the asihpi component of the ALSA Advanced Linux Sound Architecture subsystem. The find control function retrieves cached information by...

PT-2026-61192

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge pmd unshare is called to unshare a PMD table, the tlb unshare pmd ptdesc function sets tlb-unshared tables=true but the aarch64 tlb flush only checked tlb-freed...

PT-2026-61129

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in move data block" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get...

PT-2026-61127

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fs write begin may read the previously written data back from the COW inode: prepare atomic write begin locates the block in th...

PT-2026-61133

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FS COMPRESS INO uses NM Isbi-max nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress cache mount option is enable...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

CVE-2026-16158 @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...