CVE-2026-80644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80672: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

SUSE CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

SUSE CVE-2026-68459

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

SUSE CVE-2026-72034

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

SUSE CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. Several security issues in releases prior to v2.42.2...

SUSE-SU-2026:3813-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. Several security issues in releases prior to v2.42.2...

SUSE-SU-2026:3812-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

Exploit for CVE-2026-53613

CVE-2026-53613 PoC TOCTOU vulnerability in mount8 allowing...

CVE-2026-80536: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098829)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098829 advisory. In the Linux kernel, the following vulnerability has been resolved: dochangetype: refuse to operate on unmounted/not ours mounts Ensure that propagation settings can...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2026:3685-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3685-1 advisory. - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition...

UBUNTU-CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55571

djust , a Phoenix LiveView-style reactive server-side rendering library for Django, is vulnerable to an authentication bypass in versions prior to 1.0.4 . When LiveViewConsumer.handle_mount denies a mount via login_required, permission_required, or a redirecting on_mount hook, it sends a navigate...

CVE-2026-13478 Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2initfs subsys/fs/ext2/ext2impl.c by passing fsblocks = sblockscount - sfirstdatablock to ext2bitmapcountset. That helper subsys/fs/ext2/ext2bitmap.c treats its argument as a number of bits and reads one bitmap byte per...

EUVD-2026-65599

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2initfs subsys/fs/ext2/ext2impl.c by passing fsblocks = sblockscount - sfirstdatablock to ext2bitmapcountset. That helper subsys/fs/ext2/ext2bitmap.c treats its argument as a number of bits and reads one bitmap byte per...

CVE-2026-13478 Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2initfs subsys/fs/ext2/ext2impl.c by passing fsblocks = sblockscount - sfirstdatablock to ext2bitmapcountset. That helper subsys/fs/ext2/ext2bitmap.c treats its argument as a number of bits and reads one bitmap byte per...