CVE-2026-89787

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker could craft a directory entry that, when processed during a directory search, leads to an out-of-bounds read. This vulnerability can result in a use-after-free condition, potentially causing a denial of service or informatio...

CVE-2026-80808

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs in the ext4xattrblockset function, where an indefinite retry loop can be triggered when handling saturated extended attribute xattr cache entries, especially in the presence of a corrupted filesystem. A local attack...

CVE-2026-98941

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a denial of service DoS and system crash by writing encrypted data to an ext4 filesystem when encryption is enabled after mounting. This occurs because the filesystem bypasses compatibility checks for large memory bloc...

CVE-2026-80806

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorrect sequence in setting internal flags, which prevents the...

CVE-2026-92502

A flaw was found in the Linux kernel's ext4 filesystem. When the system is configured with data=journal mode, a local attacker could exploit a race condition during system reboot. This issue prevents the proper clearing of internal data flags, which can lead to data loss or corruption during the...

CVE-2026-92501

A flaw was found in the Linux kernel's ext4 filesystem. A race condition exists during direct I/O DIO operations when the system falls back to buffered I/O. This unprotected timing window allows concurrent I/O operations to incorrectly invalidate cached data, leading to input/output I/O errors. A...

CVE-2026-92500

A flaw was found in the Linux kernel's ext4 filesystem. A race condition can occur during data write operations when the system attempts to handle inline data concurrently. This timing issue can lead to a system crash, causing a denial of service, or potentially result in data loss. Mitigation...

CVE-2026-92499

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker with the ability to create or manipulate a corrupted directory can trigger a use-after-free vulnerability. This occurs when the ext4readdir function attempts to read directory entries from an invalid offset, leading to an...

CLSA-2026-1775655705 kernel-uek: Fix of 34 CVEs

ALSA: usb-audio: Fix use-after-free in sndusbmixerfree CVE-2026-23089 - HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 - KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory CVE-2024-50115 - KVM: x86: Reset IRTE to host control if new route isn't postable CVE-2025-37885...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with sfirstdatablock != 0 bigalloc with sfirstdatablock != 0 is not supported; mount it is rejected...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size A check has been added to ext4setattr to convert files from inline data storage to extent-based storage when truncate increases the file size beyond the inlin...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4fcreplayinode error paths During code review, Joseph found that ext4fcreplayinode calls ext4getfcinodeloc to get the inode location, which holds a reference to iloc.bh that must be released via brels...

CLSA-2025-1757962453 kernel: Fix of 34 CVEs

inet: fully convert sk-skrxdst to RCU rules CVE-2021-47103 - ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - can: peakusb: fix use after free bugs CVE-2021-47670 -...

CLSA-2025-1757961864 kernel: Fix of 34 CVEs

inet: fully convert sk-skrxdst to RCU rules CVE-2021-47103 - ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - can: peakusb: fix use after free bugs CVE-2021-47670 -...

CLSA-2024-1723567849 kernel: Fix of 20 CVEs

net: fix dstnegativeadvice race CVE-2024-36971 - spec: update shim Conflicts, Provides keys - ipv6: fib6rules: avoid possible NULL dereference in fib6ruleaction CVE-2024-36902 - ipv6: prevent NULL dereference in ip6output CVE-2024-36901 - drm/amd/display: Atom Integrated System Info v22 for DCN35...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15

An issue was found in the Linux kernel prior to version 6.3.3. There is an out-of-bounds read in crc16 within lib/crc16.c when accessed from fs/ext4/super.c; specifically, ext4groupdesccsum fails to properly validate an offset. NOTE: This issue has been disputed by third parties, as the kernel is...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parseapplysbmountoptions Unlike other strings in the ext4 superblock, we rely on tune2fs to ensure that smountopts ends with NUL. Harden parseapplysbmountoptions by treating smountopts as...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ext4: Fix for accessing an uninitialized lock in the fc replay path. The following kernel trace can be triggered with fstest generic/629 when executed against a filesystem with the fast-commit feature enabled: INFO: Trying to...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails in this example, because the file system disabled th...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4mbfindbygoal The issue is as follows: ... EXT4-fs mmcblk0p1: Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs...