PT-2026-61182

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Certain sleepable LSM Linux Security Module programs cannot be used with the bpf lsm task to inode function because it is called under rcu read lock, and the bpf lsm inet conn establishe...

PT-2026-61473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs and afs components where write operations for directories and links could be skipped due to lock contention and the use of WB SYNC NONE. This occurs within t...

PT-2026-61131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the f2fs file system when the flexible inline xattr feature is enabled. The do read inode function loads the i inline xattr size value from disk without...

PT-2026-61133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system where the is meta ino function unconditionally treats the F2FS COMPRESS INO as a meta inode. When the compress cache mount option is disabled, the...

PT-2026-61132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the f2fs component of the Linux kernel. The problem occurs during garbage collection when the system processes the F2FS IOC GARBAGE COLLECT RANGE...

PT-2026-61127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system during atomic write operations. When updating an atomic-write file, the f2fs write begin function may incorrectly use a COW Copy-on-Write inode to...

PT-2026-61463

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the erofs init inode xattrs function during inode extended attribute xattr initialization. The issue arises because certain error paths following the erofs read...

Linux Distros Unpatched Vulnerability : CVE-2026-53368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path,...

Linux Distros Unpatched Vulnerability : CVE-2026-63811

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back fr...

PT-2026-61149

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs3 driver where the empty-prefix xattr handler allows file owners to call setxattr directly on reserved xattrs used as internal WSL permission metadata,...

PT-2026-61126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bdev pseudo-filesystem, an internal kernel filesystem that should not be accessible to userspace. A kernel NULL pointer dereference occurs when userspace attempts ...

PT-2026-61128

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system within the destroy extent node function. When the FI NO EXTENT inode flag is set, the system fails to reset the length of the largest extent to 0...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

Linux Distros Unpatched Vulnerability : CVE-2026-63816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping =...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

EUVD-2026-42873

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814

Summary: CVE-2026-56814 affects Plug:Multipart in Elixir’s Plug.Parsers.MULTIPART, where the :length budget is applied only to part body bytes. Part headers are not counted, so requests with many empty-body file parts can slip under the length limit and create a temporary file per part, triggerin...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: CVE-2025-40216: iouring/rsrc: don't rely on user vaddr alignment bsc1259764. CVE-2025-40341: futex: Don't leak robustlist pointer on exec race bsc1255029. CVE-2025-71294:...