CVE-2026-89617

A vulnerability in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) allows a local attacker to craft a malicious NTFS log file where a tampered lcns_follow field in a DIR_PAGE_ENTRY causes an out-of-bounds write during log replay. The root cause is that check_rstbl() validates table bookkeepin...

CVE-2026-89617 fs/ntfs3: validate dirty page table on log replay

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

CVE-2026-89572 cpufreq: apple-soc: Fix OPP table cleanup

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

CVE-2026-89572 cpufreq: apple-soc: Fix OPP table cleanup

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

EUVD-2026-76484

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

CVE-2026-89572

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic, which is not the right cleanup helper for OPP...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...

EUVD-2026-76467

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89556

CVE-2026-89556 affects the Linux kernel module loader's ELF validity caching. In elf_validity_cache_sechdrs, section sizes and offsets are validated only when the section type is neither SHT_NULL nor SHT_NOBITS. However, elf_validity_cache_secstrings and elf_validity_cache_index_str subsequently ...

CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89556 module: validate string table section types

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89556 module: validate string table section types

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89525

This vulnerability affects the Linux kernel's UDF 1.50 virtual partition mapping in the function udf_get_pblock_virt15() . The root cause is an off-by-one bounds check : the code rejected only indexes greater than s_num_entries, but valid VAT indexes are strictly below that value. A crafted UDF i...

EUVD-2026-76431

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

CVE-2026-80960 dm-pcache: validate on-media seg_num against the cache device size

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...

DEBIAN-CVE-2026-72710

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

CVE-2026-72710

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

CVE-2026-72710

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

EUVD-2026-76156

SPIP before 4.4.18 contains a remote code execution vulnerability in the editerobjet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spipjobs table. Attackers...

PT-2026-90288

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the apple-soc component of the cpufreq subsystem where the apple soc cpufreq init function adds Operating Performance Point OPP tables from firmware but fails to remov...