CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89692 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

CVE-2026-89603

CVE-2026-89603 is a race condition in the Linux kernel's syscall_trace_enter() that allows seccomp filter bypass via ptrace. When a thread is stopped for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC; however, syscall_trace_enter() evaluates a cached 'work' va...

CVE-2026-89603

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...

CVE-2026-89519 sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

CVE-2026-89519 sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

EUVD-2026-76425

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

CVE-2026-89519

CVE-2026-89519 affects the Linux kernel's sched_ext (extensible scheduler) subsystem. The root cause is that SCX_RQ_BAL_KEEP , an rq-level flag used to tell the picker to keep running the previous task, becomes stale under core scheduling : because selections interleave through dispatch lock drop...

CVE-2026-89519

In the Linux kernel, the following vulnerability has been resolved: schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while...

CVE-2026-57843

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

CVE-2026-57843 NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

CVE-2026-57843

CVE-2026-57843 is an information disclosure vulnerability in NetBSD affecting the mm_open() function in sys/dev/mm.c. The root cause is that world-accessible devices such as /dev/null and /dev/zero are incorrectly assigned the PK_KMEM process flag. This allows unprivileged local users to bypass t...

EUVD-2026-76107

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

BIT-TOMCAT-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0 through 9.0.120. Th...

PT-2026-90319

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists where a seccomp filter can be bypassed after a ptrace stop. If a thread is stopped in the syscall trace enter function for ptrace, another thread can install a...

PT-2026-90473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sort folio function within the multi-generational least recently used MGLRU mechanism. The function contains a buggy shortcut for handling folios that are no longe...

PT-2026-90235

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where the use of the SCX RQ BAL KEEP flag can lead to incorrect task execution. This occurs because the flag is set at the run-queue rq level,...

PT-2026-90408

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where the nfsd break one deleg function sets the NFSD4 CALLBACK RUNNING bit to serialize recall work before calling nfsd4 run cb to queue the recall. If...

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

CVE-2026-19816

A flaw was found in PackageKit. In the dnf5 backend, the RepoRemove handler ignores the SIMULATE transaction flag and executes a real package removal, allowing an unprivileged local user to uninstall packages without polkit authorization. Mitigation Red Hat is not aware of a practical temporary...