127 matches found
CVE-2022-0185
CVE-2022-0185 Escalada de privilegios del kernel de linux escape toc DescripciĆ³n de la vulnerabilidad ID de la vulnerabilidad: CVE-2022-0185 PuntuaciĆ³n de la vulnerabilidad: Producto afectado: linux kernel - fsconfig syscall Rango de versiones afectadas: linux kernel 5.1-rc1 5.16.2 Condiciones de...
CVE-2026-89661
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...
DEBIAN-CVE-2026-80962
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...
CVE-2026-80959
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...
DEBIAN-CVE-2026-80959
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...
CVE-2026-89661 NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlockfilesystem Writing a filesystem path to /proc/fs/nfsd/unlockfilesystem runs nfsd4cancelcopybysb before nfsdmutex is held and before the handler confirms that nn-nfsdserv is set...
CVE-2026-89493
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...
EUVD-2026-76285
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...
CVE-2026-80962
A vulnerability in the Linux kernel dm-pcache (device-mapper persistent cache) component allows a local attacker with CAP_SYS_ADMIN to trigger an out-of-bounds read and write by supplying a cache device with invalid on-disk geometry metadata. The root cause is that cache_segs_init() and get_seg_i...
CVE-2026-80962
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...
CVE-2026-80961
CVE-2026-80961 affects the dm-pcache (Device-Mapper Persistent Cache) component of the Linux kernel . Two fields decoded from the cache device are left unbounded: the kset key_num , which can exceed the PCACHE_KSET_KEYS_MAX buffer before the CRC comparison, and the key's intra-segment offset and ...
CVE-2026-80960
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...
CVE-2026-80961
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...
CVE-2026-80960 dm-pcache: validate on-media seg_num against the cache device size
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...
EUVD-2026-76284
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...
EUVD-2026-76283
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...
CVE-2026-80960
CVE-2026-80960 is an out-of-bounds write vulnerability in the Linux kernel's dm-pcache (device-mapper persistent cache) module. The on-media seg_num field, read from a crc32c-only superblock, is attacker-controlled by anyone with CAP_SYS_ADMIN who supplies the cache device at table load. It is ne...
CVE-2026-80959 dm-pcache: bound the persisted tail-position offset
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...
CVE-2026-80959
CVE-2026-80959 affects the Linux kernel's dm-pcache (device-mapper persistent cache) component. The root cause is in cache_pos_decode() , which uses persisted key_tail and dirty_tail seg_off values to address data within a cache segment. A seg_off at or past the segment data_size , controllable b...
EUVD-2026-76282
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...