CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

CVE-2026-53612

A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount8 changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this...

CVE-2026-49415

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-49415 Local privilege escalation via execve(2) TOCTOU race

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

EUVD-2026-62236

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-49415

FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...

CVE-2026-54526 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines...

Bubblewrap: Root privilege escalation

Background Bubblewrap is an unprivileged sandboxing tool namespaces-powered chroot-like solution. Description A vulnerability has been discovered in Bubblewrap. Please review the CVE identifier referenced below for details. Impact An attacker could achieve root privilege escalation if Bubblewrap ...

CVE-2026-71309 vulnerabilities

Vulnerabilities for packages: rclone-fips, telegraf...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

Fuse-overlayfs (overlayfs in FUSE for rootless containers) before version 1.17 on the release-1.x C branch preserves SUID/SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file. This may allow a low-privilege process to leave the upper-layer file with mode 4777. T...

PT-2026-65846

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openO TRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-55728

Stack-based Buffer Overflow CWE-121 in /usr/bin/ltsudo cmdipaddrconflict in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly lo...

PT-2026-64300

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

UBUNTU-CVE-2026-56135

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted...

UBUNTU-CVE-2026-46572

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfsibcuttail in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory...

UBUNTU-CVE-2026-46569

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfsibcopytail, in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

UBUNTU-CVE-2026-42617

In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfsirtoib in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

PT-2026-60534

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap-based buffer overflow occurs in the build inherited id function within libntfs-3g/security.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by creating a file within ...