humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

php:7.4 security, bug fix, and enhancement update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support php 7.4.33-6 - Fix leak on double DatePeriod::construct call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 php-pear 1:1.10.13-1 - update PEAR to 1.10....

CVE-2026-80659

A flaw was found in the Linux kernel's vub300 driver. When the vub300cmndworkthread function holds a command mutex and a command response times out, the device reset path attempts to re-acquire the same mutex recursively. This recursive locking can lead to a deadlock, causing a Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-80659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the...

SUSE CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

UBUNTU-CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80659

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80659 mmc: vub300: defer reset until cmd_mutex is unlocked

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80659 mmc: vub300: defer reset until cmd_mutex is unlocked

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

EUVD-2026-67535

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

CVE-2026-80659

CVE-2026-80659 is a deadlock in the Linux kernel's vub300 MMC/USB driver. When a command response times out, __vub300_command_response() synchronously resets the USB device while vub300_cmndwork_thread() still holds cmd_mutex; the reset path re-enters the driver via vub300_pre_reset() and attempt...

PT-2026-82959

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the mmc vub300 driver due to recursive locking of the cmd mutex. The function vub300 cmndwork thread acquires cmd mutex while sending a command and waiting for a...

CVE-2026-80659: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmdmutex is unlocked vub300cmndworkthread holds cmdmutex while it sends a command and waits for the command response. If the response wait times out, vub300commandresponse kills the command URBs and...

SUSE CVE-2026-74331

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fwpmnotify calls...

EUVD-2026-66469

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

CVE-2026-80554

A flaw was found in the Linux kernel's s390/vfioccw component. The vfio-ccw logic processes channel programs recursively, breaking them into segments when a Transfer-In-Channel TIC Channel Command Word CCW is encountered. An attacker could exploit the lack of a proper limit on these segments,...

SUSE CVE-2026-80554

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

RockyLinux 10 : golang (RLSA-2026:60306)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:60306 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial ...

AZL-97772 CVE-2026-80554 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...