358 matches found
CVE-2025-39756
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INTMAX When sysctlnropen is set to a very high value for example, 1073741816 as set by systemd, processes attempting to use file descriptors near the limit can trigger massi...
Security update for atop (low)
openSUSE Security Update: Security update for atop Announcement ID: openSUSE-SU-2025:0204-1 Rating: low References: 1240393 Cross-References: CVE-2025-31160 Affected Products: openSUSE Backports SLE-15-SP6 openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available...
CVE-2025-47291
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...
CVE-2025-47291 containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...
SUSE CVE-2022-49786
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcgcssonline blkcgcssonline is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins,...
DEBIAN-CVE-2022-49786
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcgcssonline blkcgcssonline is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins,...
CVE-2022-49786
The CVE-2022-49786 issue affects the Linux kernel’s blk-cgroup subsystem. Root cause: blkcg_css_online incorrectly pinned the parent after a 397c9f46 refactor, pinning the css instead of the parent blkcg, which leads to extra pins and leakage of blkcgs and cgroups. Impact stated: leakage of blkcg...
AZL-60367 CVE-2023-52939 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in memcgrouptrackforeigndirtyslowpath As commit 18365225f044 "hwpoison, memcg: forcibly uncharge LRU pages", hwpoison will forcibly uncharg a LRU hwpoisoned page, the foliomemcg could be NULl, then,...
UBUNTU-CVE-2022-49394
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for th...
UBUNTU-CVE-2022-49413
In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different cgroup or in case of writeback just starts submitting bios associated with a different cgroup bfqmergebio can operate with stale cgroup...
CVE-2022-49647
CVE-2022-49647 affects the Linux kernel cgroups migration code. The vulnerability stems from overloading cset->mg_preload_node for both src and dst preload lists during task migrations, which could allow a cset to be simultaneously sourced and destined, risking a use-after-free if all tasks le...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from the nftsocket component of the netfilter module mishandling a warning about the maximum level of cgroups, with...
PT-2024-35520
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock issue in the Linux kernel has been identified, which can be triggered by deleting a large number of cpuset cgroups and setting cpu on and off repeatedly. This issue is caused ...
systemd bug fix update
An update is available for systemd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The systemd packages contain systemd, a system and service manager for Linux,...
kernel: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory
A flaw was found in the Linux kernel in which certain cgroup configurations could cause a kernel panic, resulting in a Denial of Service...
SUSE CVE-2024-46789
In the Linux kernel, the following vulnerability has been resolved: mm/slub: add check for s-flags in the alloctaggingslabfreehook When enable CONFIGMEMCG & CONFIGKFENCE & CONFIGKMEMLEAK, the following warning always occurs,This is because the following call stack occurred: mempoolalloc...
SUSE-SU-2024:3186-1 Security update for buildah
This update for buildah fixes the following issues: Update to version 1.35.4: CVE-2024-3727 updates bsc1224117 Bump go-jose CVE-2024-28180 Bump ocicrypt and go-jose CVE-2024-28180 Update to version 1.35.3: correctly configure /etc/hosts and resolv.conf buildah: refactor resolv/hosts setup. rename...
SUSE-SU-2024:3151-1 Security update for buildah
This update for buildah fixes the following issues: Update to version 1.35.4: Bump to Buildah v1.35.4 CVE-2024-3727 updates bsc1224117 integration test: handle new labels in 'bud and test --unsetlabel' Bump go-jose CVE-2024-28180 Bump ocicrypt and go-jose CVE-2024-28180 Update to version 1.35.3:...
CVE-2022-48944
In the Linux kernel, the following vulnerability has been resolved: sched: Fix yet more schedfork races Where commit 4ef0c5c6b5ba "kernel/sched: Fix schedfork access an invalid schedtaskgroup" fixed a fork race vs cgroup, it opened up a race vs syscalls by not placing the task on the runqueue...