CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68095 fuse-uring: fix race between registration and connection abortion

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68095 fuse-uring: fix race between registration and connection abortion

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68095

The CVE-2026-68095 entry affects Linux kernel fuse-uring, describing a race between registration and connection abortion that could leak the ring, queue, and ent if not properly synchronized. The concrete fix is to check fch->connected under fch->lock after the created ent has grabbed a ref...

fuse-overlayfs: fuse-overlayfs: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID Set User ID and SGID Set Group ID permissions on files after they are truncated or opened with the OTRUNC flag. This can enable a local attacker to...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: fuse-overlayfs: fuse-overlayfs-1.17-1.hum1 aarch64, x8664 fuse-overlayfs-1.17-1.hum1.src src...

PT-2026-69586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the binfmt misc module where the load misc binary function incorrectly sets the have execfd flag before the interpreter is actually opened. If the interpreter open...

CVE-2026-68149: Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

PT-2026-69549

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtual file system VFS helper forget cached acl where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesyste...

CVE-2026-68095: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-47243

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

fuse-overlayfs-1.17-1.1 on GA media (moderate)

fuse-overlayfs-1.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11461-1 Rating: moderate Cross-References: CVE-2026-52791 CVSS scores: CVE-2026-52791 SUSE : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2026-52791 SUSE : 5.7...

SUSE CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

UBUNTU-CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

CVE-2026-64588 fuse-uring: fix data races on ring->ready

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...