CVE-2026-76642 util-linux libmount Privilege Escalation via Failed Mount Helper

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

CVE-2026-62313

A flaw was found in Incus, a system container and virtual machine manager. A user within a project configured to forbid non-isolated containers can bypass this restriction by omitting a specific security setting security.idmap.isolated. This allows the creation of containers that share the host's...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: Set UXN on swapper page tables This issue was accidentally fixed upstream via c3cee924bd85 "arm64: head: cover the entire kernel image in the initial ID map", as part of a major refactoring of the arm64 boot process. This...

CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595

CVE-2026-74595 is an access control flaw in the Linux kernel's fscrypt component. The function fscrypt_ioctl_set_policy() incorrectly uses &nop_mnt_idmap instead of the actual mount's idmap when performing the owner check via inode_owner_or_capable(). On filesystems that support idmapped mounts (...

EUVD-2026-64532

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

Linux Distros Unpatched Vulnerability : CVE-2026-74595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an...

PT-2026-79600

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt ioctl set policy fscrypt ioctl set policy calls inode owner or capable with &nop mnt idmap before allowing an encryption policy to be set, instead of the idmap of the...

CVE-2026-62313

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

CVE-2026-62313

Incus (system container and VM manager) prior to 7.3.0 contains a bypass of the project-level restriction restricted.containers.privilege=isolated. The check only rejects an explicitly set security.idmap.isolated=false or empty value, but does not enforce the restriction when the key is omitted e...

CVE-2026-62313 Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

EUVD-2026-63986

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

CVE-2026-62313 Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

CVE-2026-62313

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100745)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100745 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops...

SUSE CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

UBUNTU-CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...