CVE-2026-53390

A flaw was found in the Linux kernel's ksmbd component. An authenticated client can exploit an out-of-bounds read vulnerability in the smbcheckpermdacl function by providing a specially crafted Access Control Entry ACE. This crafted ACE, when processed during an access check on a share that uses...

EulerOS Virtualization 2.10.1 : rsync (EulerOS-SA-2026-2837)

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver...

CVE-2026-64146

In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 "erofs: use meta buffers for xattr operations" converted xattr operations to use on-stack erofsbuf instances. erofsinitinodexattrs uses such a metabuf whil...

CVE-2026-53390 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at SIDMAXSUBAUTHORITIES, but it never checks that ace-size is actually larg...

PT-2026-61463

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the erofs init inode xattrs function during inode extended attribute xattr initialization. The issue arises because certain error paths following the erofs read...

kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks

A flaw was found in the Linux kernel's XFS filesystem. When adding extended attributes xattrs, which are metadata associated with files, to leaf blocks, incorrect adjustments to the freemap can occur. This inconsistency allows the entries array and free space to overlap, leading to an assertion...

EulerOS 2.0 SP10 : rsync (EulerOS-SA-2026-2669)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victi...

kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then...

[SECURITY] Fedora 43 Update: attr-2.6.0-1.fc43

A set of tools for manipulating extended attributes on filesystem objects, in particular getfattr1 and setfattr1. An attr1 command is also provided which is largely compatible with the SGI IRIX tool of the same name...

[SECURITY] Fedora 44 Update: attr-2.6.0-1.fc44

A set of tools for manipulating extended attributes on filesystem objects, in particular getfattr1 and setfattr1. An attr1 command is also provided which is largely compatible with the SGI IRIX tool of the same name...

OESA-2026-2914 attr security update

A set of tools for manipulating extended attributes on file system objects, in particular getfattr1 and setfattr1. An attr1 command is also provided, which is largely compatible with the SGI IRIX tool of the same name. Security Fixes: attr before version 2.6.0 contains a symlink traversal...

OESA-2026-2913 attr security update

A set of tools for manipulating extended attributes on file system objects, in particular getfattr1 and setfattr1. An attr1 command is also provided, which is largely compatible with the SGI IRIX tool of the same name. Security Fixes: attr before version 2.6.0 contains a symlink traversal...

MiracleLinux 9 : rsync-3.2.5-7.el9_8 (AXSA:2026-1207:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1207:06 advisory. rsync: rsync server leaks arbitrary client files CVE-2024-12086 rsync: Rsync: Use-after-free vulnerability in extended attribute handling...

kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then...

kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks

A flaw was found in the Linux kernel's XFS filesystem. When adding extended attributes xattrs, which are metadata associated with files, to leaf blocks, incorrect adjustments to the freemap can occur. This inconsistency allows the entries array and free space to overlap, leading to an assertion...

CVE-2026-52962

A flaw was found in the Linux kernel, specifically within the Ceph file system's extended attribute handling. A buffer leak occurs in the cephsetxattr function because a previously allocated buffer oldblob is not properly released. This can lead to resource exhaustion over time, potentially causi...

CVE-2026-53041

A flaw was found in the Linux kernel's Oracle Cluster File System version 2 OCFS2. When an OCFS2 inode has both inline and and block-based extended attributes xattrs, the listxattr function can return a size larger than the caller's buffer. This incorrect size handling can lead to a kernel bug an...

Linux Distros Unpatched Vulnerability : CVE-2026-53041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix listxattr handling when the buffer is full BUG If an OCFS2 inode has both inline and block- based xattrs, listxattr can return a size larger than the...

CVE-2026-53041

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full BUG If an OCFS2 inode has both inline and block-based xattrs, listxattr can return a size larger than the caller's buffer when the inline names consume that buffer exactly...

CVE-2026-52962 ceph: fix a buffer leak in __ceph_setxattr()

In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in cephsetxattr The oldblob in cephsetxattr can store ci-ixattrs.preallocblob value during the retry. However, it is never called the cephbufferput for the oldblob object. This patch fixes the issue of the...