EUVD-2026-67548

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...

CVE-2026-80644 ocfs2: don't BUG_ON an invalid journal dinode

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

EUVD-2026-67520

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80644

CVE-2026-80644 affects the OCFS2 filesystem in the Linux kernel. A commit (10995aa2451a) replaced a -EIO return in ocfs2_journal_toggle_dirty() with a BUG_ON(), assuming the journal dinode was already validated. A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is in pr...

SUSE CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-80672: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

SUSE CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

SUSE CVE-2026-68459

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

SUSE CVE-2026-72034

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

SUSE CVE-2026-80537

In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. Several security issues in releases prior to v2.42.2...

SUSE-SU-2026:3813-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. Several security issues in releases prior to v2.42.2...

SUSE-SU-2026:3812-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

Exploit for CVE-2026-53613

CVE-2026-53613 PoC TOCTOU vulnerability in mount8 allowing...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098829)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098829 advisory. In the Linux kernel, the following vulnerability has been resolved: dochangetype: refuse to operate on unmounted/not ours mounts Ensure that propagation settings can...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2026:3685-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3685-1 advisory. - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition...

UBUNTU-CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...