Virtualenv: Deletion Recovery Can Change A Symlink Target's Mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as "ANT-2026-UK90QC27" in "virtualenv-20261015-005...

SUSE CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-80786

A flaw was found in the fbdev subsystem of the Linux kernel. This vulnerability occurs because certain user-invoked display mode changes, specifically those not using the FBIOPUTVSCREENINFO ioctl, fail to properly update the fbcon state. A local user could potentially exploit this by triggering a...

CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

EUVD-2026-105017

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

PT-2026-118385

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38433)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setOpModeCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bonding: Fixed a NULL dereference of the struct bonding.rrtxcounter member. This issue occurs because if a bond is created with an initial mode != zero Round Robin, the memory required for the counter is never allocated. When...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073357)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073357 advisory. In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears...

SUSE CVE-2026-80786

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

AZL-99558 CVE-2026-80786 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786

CVE-2026-80786 affects the Linux kernel fbdev (framebuffer) subsystem. The root cause is that user-invoked calls to fb_set_var() from sysfs and driver code paths were missing fbcon -related steps (checking mode-change feasibility, updating hardware state, and updating fbcon). Only the FBIOPUT_VSC...

EUVD-2026-71429

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

PT-2026-85627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev component where user-invoked calls to the fb set var function were not consistently handling fbcon during display updates. While the FBIOPUT VSCREENINFO ioct...

CVE-2026-80786: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

PT-2026-91337

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fb set var in helper Handle fbcon during display updates in fb set var from user. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all...