DEBIAN-CVE-2026-89492

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

AZL-100235 CVE-2026-89492 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

DEBIAN-CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

CVE-2026-89576

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

CVE-2026-89601

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1; else markinodedirtyinode; which leads to lost inode updates for ISSYNC inodes because...

UBUNTU-CVE-2026-89576

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadatatakesnap bumps the live superblock refcount and then dmtmshadowblock allocates a new block for the metadata snapshot. If the subsequent dmsmincblock of...

CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

UBUNTU-CVE-2026-89574

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

UBUNTU-CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

UBUNTU-CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

UBUNTU-CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

UBUNTU-CVE-2026-89492

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

CVE-2026-80962

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cacheinfo cachesegsinit iterates cacheinfo-nsegs times indexing cache-segments, which is sized to the cache device geometry, and getsegid takes each segment id from the on-media...

CVE-2026-89492

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666

CVE-2026-89666 affects the Linux kernel's nfsd (NFS server daemon). A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD carrying an atime or mtime whose nseconds field is out of range —it decodes as a valid uint32 but is not a valid timespec64. Nothing in the setattr path clamps ...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...