99 matches found
CVE-2026-99228
The Linux kernel contains a vulnerability in io_uring/io-wq where threads can hang indefinitely during exit if they submitted an IORING_OP_OPENAT request for a FIFO without a writer using IOSQE_ASYNC. The root cause is that workers for bounded work (like fifo_open) might lose the signal intended ...
SUSE CVE-2026-109411
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
CVE-2026-109411
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
DEBIAN-CVE-2026-109411
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
CVE-2026-109411 Samba: access control bypass via vfs_ceph_rgw case-insensitive open
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
CVE-2026-109411
An access control bypass flaw was found in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using mismatch...
CVE-2026-109411 Samba: access control bypass via vfs_ceph_rgw case-insensitive open
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
CVE-2026-109411 Samba: access control bypass via vfs_ceph_rgw case-insensitive open
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
CVE-2026-109411
An access control bypass flaw exists in Samba's vfs_ceph_rgw module within the openat() function. When an authenticated user requests an existing file using mismatched character casing, the module fails to perform a correct case-insensitive lookup, leading the server to treat the request as a new...
EUVD-2026-112398
An access control bypass flaw was found in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using mismatch...
CVE-2026-109411: Improper Handling of Case Sensitivity
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
Samba input validation error vulnerability
A vulnerability related to input validation exists in Samba versions 4.25.0 through 4.25.1. This vulnerability stems from an access control bypass in the openat function within the vfscephrgw module. Authenticated users can exploit this by requesting files whose names do not match case, causing t...
PT-2026-129130
An access control bypass flaw was found in Samba's vfs ceph rgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs ceph rgw module. When a client requests an existing file using...
CVE-2026-109411
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: iouring: A filename leak was addressed in ioopenatprep. The ioopenatprep function allocates a struct filename using getname. However, if the file is installed in the fixed file table and the OCLOEXEC flag is set, the function...
AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2024:1718202007)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718202007 advisory. - linux-pam aka Linux PAM before 1.6.0 allows attackers to cause a denial of service blocked login process via mkfifo because the openat call...
CLSA-2026-1784901236 golang: Fix of CVE-2026-39822
CVE-2026-39822: fix os.Root escape via trailing slashes in symlink paths where openat resolved a slash-terminated final component, allowing operations to escape the root...
Linux io_uring File Read
Upload a small helper that reads a remote file via iouring OPENAT/READV/CLOSE, falling back to raw syscalls if needed. Useful to bypass userland libc hooks that only intercept open/read/cat. !/usr/bin/env python3 -- coding: utf-8 -- """Read a remote Linux file via an iouring helper syscall...
Linux kernel io_uring Heap Buffer Overflow DoS
The vulnerability of the ioopenatprep function in the iouring/openclose.c module, which is part of the Linux kernel’s asynchronous input/output interface, relates to the failure to release resources after their useful period has ended. Exploiting this vulnerability could allow an attacker to caus...
GHSA-GWM6-Q8CH-HCFR install -D: symlink race in directory creation allows arbitrary file overwrite
The -D path runs fs::createdirall on a pathname then later opens the destination via path-based File::create/fs::copy, neither anchored to a directory fd. Between the two, an attacker can replace a path component with a symlink, redirecting the write. Impact: an attacker with concurrent write...