Linux Distros Unpatched Vulnerability : CVE-2026-53368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path,...

Linux Distros Unpatched Vulnerability : CVE-2026-63811

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back fr...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

CVE-2026-63817: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compresscache mount option is enabled. Wh...

Linux Distros Unpatched Vulnerability : CVE-2026-63816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping =...

The vulnerability of the cow_file_range() function in the fs/btrfs/inode.c module of the file system Btrfs in the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the cowfilerange function in the fs/btrfs/inode.c module of the btrfs file system in the Linux kernel lies in the absence of resource locking in case of errors. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

EUVD-2026-42873

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814

Summary: CVE-2026-56814 affects Plug:Multipart in Elixir’s Plug.Parsers.MULTIPART, where the :length budget is applied only to part body bytes. Part headers are not counted, so requests with many empty-body file parts can slip under the length limit and create a temporary file per part, triggerin...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814: Allocation of Resources Without Limits or Throttling

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: CVE-2025-40216: iouring/rsrc: don't rely on user vaddr alignment bsc1259764. CVE-2025-40341: futex: Don't leak robustlist pointer on exec race bsc1255029. CVE-2025-71294:...

SUSE-SU-2026:2799-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Ultra definitions bsc1266290. - CVE-2025-40216: iouring/rsrc: don't rely on user vaddr alignment bsc1259764. - CVE-2025-40341:...

The vulnerability of the ext4_get_journal inode() function in the fs/ext4/super.c file of the Ext4 file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4getjournal inode function in the fs/ext4/super.c file of the Ext4 file system in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

GHSA-7CR3-H577-G38J rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...

The vulnerability of the ext4_xattr inode_create() function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ext4xattr inodecreate function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system is related to the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability could allow an attacker to cause service...

SUSE-SU-2026:2238-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 bsc1243603. - CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache bsc1264013. -...