EUVD-2026-76688

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-89701

CVE-2026-89701 is a validation flaw in the Linux kernel's nfsd (NFS server daemon). The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths store a raw uint32_t nseconds value directly into tv_nsec without enforcing the nseconds

EUVD-2026-76613

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701 nfsd: validate nseconds in TIME_DELEG decode paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701 nfsd: validate nseconds in TIME_DELEG decode paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89657

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

CVE-2026-89611 ntfs: validate non-resident attribute offsets

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89610 ntfs: verify run length exceeding volume boundary

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

CVE-2026-89584 block: validate user space vectors during extraction

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89494 ocfs2: validate lengths in dlm_mig_lockres_handler

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

CVE-2026-89494 ocfs2: validate lengths in dlm_mig_lockres_handler

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-81915

Concrete CMS below 9.5.3 has a missing object-level authorization check in the Types::submit() dashboard controller. When updating a Page Type, the controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user a...