394248 matches found
CVE-2026-72222
In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...
CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...
CVE-2026-72217
The CVE-2026-72217 issue concerns SUNRPC in the Linux kernel where xdr_buf_to_bvec() writes a bio_vec before validating the destination slot, allowing an out-of-bounds write when budget is exhausted. The rq_bvec array used by nfsd_vfs_write() is allocated to rq_maxpages with no slack, so an overf...
CVE-2026-72211
The CVE concerns the Linux kernel NTFS handling in ntfs_ir_reparent(), where a root stub may grow beyond the resident index root value. The code can publish a larger index header (index_length/allocated_size) before resizing the resident value, so if a resize fails with ENOSPC, recovery paths may...
CVE-2026-72208
CVE-2026-72208 affects the Linux kernel NTFS EA handling code. The vulnerability arises from insufficient bounds checking in ntfs_ea_lookup and ntfs_listxattr, where the code accesses the next_entry_offset field of an EA entry without verifying there is enough space. The issue is resolved in the ...
CVE-2026-72208 ntfs: add bounds check before accessing EA entries
In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...
CVE-2026-72209
CVE-2026-72209 concerns the Linux kernel NTFS attribute value handling. The fix adds a shared attribute value validator and applies it before any lookup path can return an attribute (including AT_UNUSED). The validator enforces bounds for resident values, minimum resident sizes, checks variable-l...
CVE-2026-72206
The CVE-2026-72206 entry concerns the Linux kernel NTFS index block validation. A stricter validation was added for INDEX_HEADER geometry in INDX blocks via ntfs_index_block_inconsisent(), and ntfs_lookup_inode_by_name() was updated to use this validation. This fixes a vulnerability in how INDX b...
EUVD-2026-58962
In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...
EUVD-2026-58958
In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...
CVE-2026-72201
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...
CVE-2026-72200 ntfs: detect mapping-pairs LCN accumulator overflow
In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...
CVE-2026-72200
CVE-2026-72200 affects Linux kernel NTFS support: the mapping-pairs parser can overflow when accumulating relative LCN deltas in a signed integer, potentially turning a corrupted runlist into a different set of physical clusters. Root cause: signed overflow when a runlist shape reaches S64_MAX an...
CVE-2026-72201
CVE-2026-72201 affects the Linux kernel NTFS implementation where index entries are validated after reading an index root or block. Root cause: insufficient immediate validation of index entries during lookup/readdir paths, leading to potential missed checks. The CVSS appears CRITICAL (Network, N...
CVE-2026-72199
The CVE refers to the Linux kernel ntfs patch that validates resident index root values on lookup. The fix ensures 8-byte alignment of index header fields, sane entries_offset, index_length within allocated_size, and allocated_size consistency within the resident value, and it validates header in...
CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...
CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...
CVE-2026-72197
The CVE-2026-72197 issue affects the Linux kernel, specifically the fs/ntfs3 path for DeleteIndexEntryAllocation. The root cause is that e->size can cause an overlong memmove when e + e->size points past hdr + hdr->used, leading to a dangerous memmove length. A corresponding guard alread...
EUVD-2026-58955
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...