Linux Distros Unpatched Vulnerability : CVE-2026-90321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: validate inline xattrs during inode block validation Patch series ocfs2: validate xattr entry bounds, v7. This series validates OCFS2 xattr entry...

EUVD-2026-81982

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

CVE-2026-90321 ocfs2: validate inline xattrs during inode block validation

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

CVE-2026-90321

CVE-2026-90321 affects the Linux kernel's OCFS2 filesystem . The root cause is that ocfs2_validate_inode_block() did not validate inline extended-attribute (xattr) entry name/value bounds, allowing getxattr() or listxattr() to walk out-of-range entries from corrupted metadata , leading to a use-a...

CVE-2026-90321 ocfs2: validate inline xattrs during inode block validation

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.28. It stems from ocfs2’s failure to validate the boundaries of the name and value of inline xattr entries during inode validation. This allows getxattr or listxattr to traverse an array of out-of-bounds metadata entries, potentially...

SUSE CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

CVE-2026-63815 (Linux kernel, f2fs) : The vulnerability arises when flexible_inline_xattr is enabled; do_read_inode() unconditionally loads i_inline_xattr_size from disk, but sanity_check_inode() only validates it if FI_INLINE_XATTR is set. This enables an attacker-controlled i_inline_xattr_size ...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

EUVD-2026-45481

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

PT-2026-61131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the f2fs file system when the flexible inline xattr feature is enabled. The do read inode function loads the i inline xattr size value from disk without...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005411)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005411 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: add bounds checking in getmaxinlinexattrvaluesize Normally the extended attributes in the...

Linux file system Kernel Buffer Overflow

The vulnerability of the getmaxinlinexattrvaluesize function in the fs/ext4/inline.c module of the Linux file system’s kernel is related to operations that go beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2025-71105

CVE-2025-71105 documents a Linux kernel issue in f2fs where two slab caches (f2fs_xattr_entry-7:3 and f2fs_xattr_entry-7:7) with identical slab sizes cause kmem_cache_sanity_check warnings during mount operations. The root cause is using per-sb slab caches instead of a single global slab, leading...

CVE-2025-71105

In the Linux kernel, the following vulnerability has been resolved: f2fs: use global inlinexattrslab instead of per-sb slab cache As Hong Yun reported in mailing list: loop7: detected capacity change from 0 to 131072 ------------ cut here ------------ kmemcache of name 'f2fsxattrentry-7:7' alread...

CVE-2025-71105

In the Linux kernel, the following vulnerability has been resolved: f2fs: use global inlinexattrslab instead of per-sb slab cache As Hong Yun reported in mailing list: loop7: detected capacity change from 0 to 131072 ------------ cut here ------------ kmemcache of name 'f2fsxattrentry-7:7' alread...