PT-2026-61127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system during atomic write operations. When updating an atomic-write file, the f2fs write begin function may incorrectly use a COW Copy-on-Write inode to...

CVE-2026-64146: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 "erofs: use meta buffers for xattr operations" converted xattr operations to use on-stack erofsbuf instances. erofsinitinodexattrs uses such a metabuf whil...

PT-2026-61473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs and afs components where write operations for directories and links could be skipped due to lock contention and the use of WB SYNC NONE. This occurs within t...

PT-2026-61133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system where the is meta ino function unconditionally treats F2FS COMPRESS INO as a meta inode. This occurs even when the compress cache mount option is...

PT-2026-61132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the f2fs component of the Linux kernel. The problem occurs during garbage collection when the system processes the F2FS IOC GARBAGE COLLECT RANGE...

PT-2026-61131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the f2fs file system when the flexible inline xattr feature is enabled. The do read inode function loads the i inline xattr size value from disk without...

PT-2026-61463

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the erofs init inode xattrs function during inode extended attribute xattr initialization. The issue arises because certain error paths following the erofs read...

PT-2026-61128

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs component where the destroy extent node function incorrectly handles the FI NO EXTENT inode flag. When this flag is set, the function fails to reset the lengt...

PT-2026-61149

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs3 driver where the empty-prefix xattr handler allows file owners to call setxattr directly on reserved xattrs used as internal WSL permission metadata,...

Linux Distros Unpatched Vulnerability : CVE-2026-53368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path,...

Linux Distros Unpatched Vulnerability : CVE-2026-63811

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back fr...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

CVE-2026-63817: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compresscache mount option is enabled. Wh...

Linux Distros Unpatched Vulnerability : CVE-2026-63816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping =...

The vulnerability of the cow_file_range() function in the fs/btrfs/inode.c module of the file system Btrfs in the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the cowfilerange function in the fs/btrfs/inode.c module of the btrfs file system in the Linux kernel lies in the absence of resource locking in case of errors. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

EUVD-2026-42873

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814

Summary: CVE-2026-56814 affects Plug:Multipart in Elixir’s Plug.Parsers.MULTIPART, where the :length budget is applied only to part body bytes. Part headers are not counted, so requests with many empty-body file parts can slip under the length limit and create a temporary file per part, triggerin...

CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...

CVE-2026-56814

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part...