252 matches found
CVE-2023-0386
README root@kitploit: gcc -Wall exp.c pkg-config fuse --cflags --libs -o exp ./exp /tmp Vulnerability Analysis The theoretical knowledge in this article namespaces, overlay filesystem, fuse filesystem, etc. comes from ChatGPT. Vulnerability Overview Vulnerability ID: CVE-2023-0386 Vulnerable...
CVE-2022-1011
CVE-2022-1011 Fix link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=0c4bcfdecb1ac0967619ee7ff44871d93c08c909 This vulnerability is mainly due to the asynchronous nature of splice, which allows the user-mode filesystem process server side to retain a piece of memor...
CVE-2023-0386
Installation root@kitploit: make all How to use Start two terminals and in the first one type root@kitploit: ./fuse ./ovlcap/lower ./gc In the second terminal type root@kitploit: ./exp...
Astra Linux – Vulnerability in Linux
A issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, also known as CID-5d069dbe8aaf. The fusedogetattr function calls makebadinode in inappropriate situations, causing a system crash. NOTE: The original fix for this vulnerability was incomplete, and its...
CVE-2023-0386-OverlayFS
CVE-2023-0386 - OverlayFS / FUSE 原始 CVE 源代码由 xkaneiki 编写： https://github.com/xkaneiki/CVE-2023-0386/tree/main 已重写，使漏洞利用可以在 1 个 shell 中运行（原始漏洞利用需要 2 个 shell）。 root@kitploit: Compile make all Create mount point for fuse filesystem mkdir -p /tmp/fusepwn/lower Start fuse which serves a SUID binary...
Astra Linux – Vulnerability in Linux, Linux 5.10
A use-after-free flaw was discovered in the Linux kernel’s FUSE filesystem, where a user triggers the write function. This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation...
SUSE CVE-2026-68149
In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...
CVE-2026-68149
A flaw was found in the Linux kernel. The forgetcachedacl helper function, intended to manage Access Control List ACL caching, incorrectly invalidates the ACLDONTCACHE state. This can lead to a Fuse Filesystem in Userspace filesystem returning stale cached ACL values. Consequently, this could...
CVE-2026-68149
In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...
UBUNTU-CVE-2026-68149
In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...
CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...
PT-2026-69549
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtual file system VFS helper forget cached acl where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesyste...
SUSE CVE-2026-53311
In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fusedentryrevalidate fusedentryrevalidate may be called with a dentry that didn't had -dtime initialised. The issue was found with KMSAN, where lookupopen calls dalloc, followed by drevalidate, as shown...
CVE-2026-53311
In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fusedentryrevalidate fusedentryrevalidate may be called with a dentry that didn't had -dtime initialised. The issue was found with KMSAN, where lookupopen calls dalloc, followed by drevalidate, as shown...
AZL-90761 CVE-2026-53167 affecting package kernel for versions less than 6.6.144.1-1
In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios FUSENOTIFYRETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSENOTIFYRETRIEVE is intended to only return data that is already in...
SUSE-SU-2026:22421-1 Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues The following security issues were fixed: - CVE-2026-23278: netfilter: nftables: always walk all pending catchall elements bsc1260907. - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache...
Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise 15 SP6)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.103 fixes various security issues The following security issues were fixed: CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache bsc1261640. CVE-2026-31504: net: fix fanout UAF in packetrelease via NETDEVUP race...
EUVD-2026-31254
When a fusefs file system implements extended attributes, the kernel may send a FUSELISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: fuse: fixed the runtime warning in truncatefoliobatchexceptionals The WARNONONCE flag was introduced in truncatefoliobatchexceptionals to determine whether the filesystem has removed all DAX entries. This fix has been applied ...
