138 matches found
CLEANSTART-2025-OV35077 receive_xattr function in xattrs
Security vulnerability affects the rsync package. The receivexattr function in xattrs...
CVE-2026-98543
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...
EUVD-2026-103588
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...
CVE-2026-98543: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...
CVE-2026-90132
A flaw was found in the Linux kernel's NTFS filesystem. This vulnerability allows an unprivileged local user to bypass intended access controls by modifying reserved extended attributes xattrs, such as $LXUID, $LXGID, $LXMOD, and $LXDEV, through the setxattr function. This unauthorized modificati...
OverlayFS FUSE LPE (CVE-2023-0386)
Local privilege escalation via CVE-2023-0386: FUSE + overlayfs copyup mishandles user xattrs on privileged files, allowing a low-privilege user to write SUID shell or /etc/passwd entries. Compiles and uploads the exploit to the target session requires libfuse-dev on operator host. !/usr/bin/env...
Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_9348)
The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259348 advisory. kernel: proc: fix UAF in procgetinode CVE-2025-21999 kernel: ext4: fix off-by-one error in dosplit CVE-2025-23150 kernel: ext4: ignore xattrs past end...
SUSE CVE-2026-90132
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
SUSE CVE-2026-90321
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...
Linux Distros Unpatched Vulnerability : CVE-2026-90132
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved...
CVE-2026-90321
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...
AZL-102530 CVE-2026-90321 affecting package kernel for versions less than 6.6.161.1-1
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...
DEBIAN-CVE-2026-90132
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
CVE-2026-90132
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
CVE-2026-90132 ntfs: reject unprivileged writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
CVE-2026-90132
CVE-2026-90132 affects the Linux kernel's NTFS filesystem driver . An unprivileged local user can call setxattr on the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes without holding CAP_SYS_ADMIN , allowing modification of file metadata (owner, group, modification time, device nu...
CVE-2026-90132 ntfs: reject unprivileged writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
EUVD-2026-81725
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...
PT-2026-94480
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where unprivileged users can write to reserved extended attributes xattrs. Specifically, the setxattr function fails to restrict the modification of...
PT-2026-96356
In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...