EUVD-2026-86921

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

EUVD-2026-86698

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98045

The Linux kernel contains a vulnerability where the faultable variants of bpf_get_stack() and bpf_get_task_stack() do not correctly set the might_sleep property. This allows these helpers to be called from non-sleepable regions, such as RCU or preemption-disabled regions, because the verifier may...

CVE-2026-98045 bpf: Mark faultable stack helpers as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-97927

The Linux kernel contains a vulnerability in the ufs filesystem where ufs_fill_super() installs the root dentry before successfully loading cylinder group structures for writable mounts. If ufs_read_cylinder_structures() fails, the error path frees the in-core superblock information and sets sb-&...

CVE-2026-97551 xfs: initialise args->total for parent pointer updates

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

EUVD-2026-86859

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

CVE-2026-97551

The Linux kernel 's xfs filesystem contains a vulnerability where xfs_parent_da_args_init() initializes xfs_parent_args with a zeroed value, leaving args->total at 0. During attribute fork growth, xfs_da_grow_inode_int() treats this as a running block reservation; because it is an xfs_extlen_t...

CVE-2026-97551 xfs: initialise args->total for parent pointer updates

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

CVE-2026-79143

A flaw was found in Google Chrome's FileSystem component. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By leveraging social engineering techniques with a specially crafted HTML page, an attacker can exploit this flaw, leading to...

OESA-2026-4082 docker security update

Security Fixes: Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or...

Linux Distros Unpatched Vulnerability : CVE-2026-97551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total ==...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-97551

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

CVE-2026-97927: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21921-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21921-1 advisory. Changes in chromium: - Chromium 153.0.8010.52 boo1281123: CVE-2026-93374: Use after free in Dawn CVE-2026-93372: Buffer overflow in WebGL...

CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98080: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

Linux Distros Unpatched Vulnerability : CVE-2026-98080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS=-O quota, it has a high...

GHSA-FGMF-7RF8-M6VF ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...