CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98980

The Linux kernel contains a vulnerability where refwalk can reveal overmounted entries in a very narrow window. While rcuwalk validates dentries before acceptance via step_into(), lookup_fast() in refwalk accepts hashed dentries without this recheck. If an entry is unlinked after a reference is t...

CVE-2026-98980 namei: don't reveal overmounted entries in refwalk

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

PT-2026-121961

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dont mount on the victim and then detach mounts with the victim's inode locked. do lock mount takes the inode lock of the mountpoint an...

Linux Distros Unpatched Vulnerability : CVE-2026-98984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's...

SUSE CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

Linux Distros Unpatched Vulnerability : CVE-2026-112940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX...

DEBIAN-CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112940

The filelock Python library contains a vulnerability in the ReadWriteLock component (versions 3.20.4 through 4.2.1) where SQLite reopens the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap file names to force the locking ...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

PT-2026-118401

Name of the Vulnerable Software and Affected Versions filelock versions 3.20.4 through 4.2.0 Description The ReadWriteLock allows SQLite to reopen the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap these names to trigger...

PT-2026-116762

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF LSM Linux Security Module where the verifier incorrectly assumes that the inode is locked during path unlink and path rmdir operations. Specifically, bpf lsm h...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: 9p: Added missing locking around accessing the dentry fid list. Fixed a use-after-free issue when a thread accesses the dentry’s dfsdata fid list while another thread unlinks it from the dentry. UAF thread issues: - refcountt:...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: ocfs2: dlmfs: fix error handling of userdlmdestroylock When userdlmdestroylock failed, it did not clean up the flags it set prior to exiting. For USERLOCKINTEARDOWN, if this function fails because the lock is still in use, the ne...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...