CVE-2026-43314

CVE-2026-43314 affects the Linux kernel device mapper (dm) driver. The issue arises when an I/O timeout failure is injected into a dm device; because dm does not implement its own timeout handler, the request can leak and hang indefinitely. The root cause is the presence of blk_should_fake_timeou...

CVE-2026-43314 dm: remove fake timeout to avoid leak request

In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request Since commit 15f73f5b3e59 "blk-mq: move failure injection out of blkmqcompleterequest", drivers are responsible for calling blkshouldfaketimeout at appropriate code paths and...

CVE-2026-7582

A flaw was found in AcademySoftwareFoundation OpenImageIO, affecting the DDS Image Handler component. A local attacker could exploit an out-of-bounds write vulnerability by providing a specially crafted image file. This could lead to information disclosure, denial of service, or potentially...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iouring: Check whether iowq is killed before queuing it. Task work can be executed after the task has gone through iouring termination—whether it’s the final taskwork run or the fallback path. In this case, task work will find th...

PT-2026-38941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug exists in the Btrfs file system where the kernel may crash if the file system switches to read-only RO mode during a read-repair operation. This occurs when a critical error, such ...

Linux Distros Unpatched Vulnerability : CVE-2026-43314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: remove fake timeout to avoid leak request Since commit 15f73f5b3e59 blk-mq: move failure injection out of blkmqcompleterequest, drivers are responsible for...

PT-2026-39103

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring component where the boundary check for 128-byte Submission Queue Entry SQE operations in the io init req function validates the logical SQ head position...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a physical SQE boundary-checking error involving a 128-byte operation in iouring, potentially...

PT-2026-39281

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description The ydoc:document:update Socket.IO event handler fails to verify if a sender has write permissions, checking only if the sender is a member of the document's Socket.IO room. Users with read-only...

PT-2026-38989

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Btrfs file system where qgroup ioctls do not reserve sufficient space for transaction items. Instead, they perform a transaction join, which fails to reserve space...

Linux Distros Unpatched Vulnerability : CVE-2026-43334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SMP: force responder MITM requirements before building the pairing response smpcmdpairingreq currently builds the pairing response from the initiator...

Linux Distros Unpatched Vulnerability : CVE-2026-43338

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't reserve any space, they just do a transaction join, which does not...

CVE-2026-41490 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating...

CVE-2026-41490 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating...

Linux Distros Unpatched Vulnerability : CVE-2026-43174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/zcrx: fix post open error handling Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do th...

CVE-2026-43174

A flaw was found in the Linux kernel's iouring/zcrx subsystem. Incorrect error handling during post-open operations allows for the direct release of zcrx ctx without ensuring that all associated page pools are properly terminated. This resource management issue could lead to system instability or...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.3.4 version. Hence, IBM strongly recommends upgrading to 1.3.4...

EUVD-2026-27692

In the Linux kernel, the following vulnerability has been resolved: dm-verity: correctly handle dmbufioclientcreate failure If either of the calls to dmbufioclientcreate in verityfecctr fails, then dmbufioclientdestroy is later called with an ERRPTR argument. That causes a crash. Fix this...

CVE-2026-43147

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" This reverts commit 05703271c3cd "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV", which causes a deadlock by recursively takin...

CVE-2026-43224 io_uring/zcrx: fix sgtable leak on mapping failures

In the Linux kernel, the following vulnerability has been resolved: iouring/zcrx: fix sgtable leak on mapping failures In an unlikely case when iopopulateareadma fails, which could only happen on a PAGEPOOL32BITARCHWITH64BITDMA machine, iozcrxmaparea will have an initialised and not freed table. ...