In the Linux kernel, the following vulnerability has been resolved:
fs: don't silently unmount busy mounts
The propagate_mount_busy() helper exists to decide whether a synchronous
can suceed. It does that by looking at the copies of the victims in…
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle
into the doorbell domain. For a regular BO, TTM moves…
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't let a pseudo dentry become the root of a mount
d_alloc_pseudo() hands out dentries for pipes, sockets and other files
that are never anyone's child or parent. They carry…
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the
nsproxy is installed into a task in…
In the Linux kernel, the following vulnerability has been resolved:
dcache: don't put a mountpoint on a dentry that's being removed
rmdir(), unlink() and rename() call dont_mount() on the victim and then
detach_mounts() with the victim's inode locked.…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check the mounts before reading their parents in pivot_root()
path_pivot_root() reads the parents of new_root and of the caller's root
and checks whether they are shared before…
In the Linux kernel, the following vulnerability has been resolved:
namespace: remove the fsnotify marks of a mount namespace in process context
mnt_ns_release() drops the last passive reference of a mount namespace
and removes its fanotify marks via…
In the Linux kernel, the following vulnerability has been resolved:
namespace: look at the topmost mount for a mount namespace file
attach_recursive_mnt() preallocates a mountpoint for the root of the
topmost mount of the source so that a mount that…
In the Linux kernel, the following vulnerability has been resolved:
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a
copy of the tree at the given path. The caller needs to be…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check a recursive bind mount for mount namespace loops
do_loopback() refuses to bind mount the file of a mount namespace that
is as old as the caller's or older because a mount…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check a submount for references right before unmounting it
shrink_submounts() and mark_mounts_for_expiry() first collect all the
mounts they are allowed to unmount and then…
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug…
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size,
xmi_can_exchange_reflink_flags() assumes every mapping moved…
In the Linux kernel, the following vulnerability has been resolved:
namespace: keep the lock on a mount that a propagated copy is moved beneath
attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the
mount that is moved beneath it with…
In the Linux kernel, the following vulnerability has been resolved:
namespace: handle mount locking for automounts correctly
If mounts are propagated across user namespaces, attach_recursive_mnt()
locks every copy of the source mount to protect overmounts…
In the Linux kernel, the following vulnerability has been resolved:
namespace: never expire a locked mount
Locked mounts are special. They protect the underlying files and
directories from being revealed. do_umount() refuses to unmount locked
mounts but…
In the Linux kernel, the following vulnerability has been resolved:
namespace: refuse an automount below a mount that is in no namespace
It's possible to add autmounts even when the parent mount isn't in the
mount namespace of the caller. The only…
In the Linux kernel, the following vulnerability has been resolved:
namei: don't reveal overmounted entries in refwalk
In rcuwalk the dentry is validated before it is accepted. step_into()
step_into() rechecks d_seq and __follow_mount_rcu() rechecks…
In the Linux kernel, the following vulnerability has been resolved:
namespace: unhash a dentry before detaching the mounts on it
unlink(), rmdir() and rename() remove the entry from the filesystem,
call detach_mounts() on the entry with the inode locked…
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix the program leak when XDP is replaced
We need to release the reference on the old BPF prog, whether
we are going to no-prog, or replacing the prog with another.
Spotted by AI…
In the Linux kernel, the following vulnerability has been resolved:
cxgb4/ch_ktls: disable softirqs around tid_list erases
chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
using xa_insert_bh(). The array is shared by the adapter's…
In the Linux kernel, the following vulnerability has been resolved:
amt: send the relay's General Query directly from the receive path
An skb queued in a qdisc can outlive the tunnel it references
through a raw pointer in skb->cb. For example, with…
In the Linux kernel, the following vulnerability has been resolved:
net/sched: em_text: reject unterminated algo before autoload
This is a follow-up to commit 9c572a83037a ("net/sched: fix potential
stack infoleak in em_text_dump()"), which…
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Free the BO cache size list on teardown
vc4_bo_cache_destroy() purges the cached BOs but never frees the size
list, leaking it on every unbind.
In the Linux kernel, the following vulnerability has been resolved:
gpio: exar: initialize the ID before registering its cleanup
devm_add_action_or_reset() invokes the cleanup action immediately when
registering the action fails. gpio_exar_probe()…
Brak pełnej ocenyOpis źródłowy · EN
CVSS
Nieustalone
EPSS
0,17 %
Publikacja
Poprawka
Status poprawki nieustalony
Podatności: CVE, produkt, opis, sygnały zagrożenia, CVSS, EPSS i data publikacji.
In the Linux kernel, the following vulnerability has been resolved:
fs: don't silently unmount busy mounts
The propagate_mount_busy() helper exists to decide whether a synchronous
can…
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
amdgpu_userq_get_doorbell_index() pins any BO passed as…
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't let a pseudo dentry become the root of a mount
d_alloc_pseudo() hands out dentries for pipes, sockets…
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an…
In the Linux kernel, the following vulnerability has been resolved:
dcache: don't put a mountpoint on a dentry that's being removed
rmdir(), unlink() and rename() call dont_mount() on…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check the mounts before reading their parents in pivot_root()
path_pivot_root() reads the parents of…
In the Linux kernel, the following vulnerability has been resolved:
namespace: remove the fsnotify marks of a mount namespace in process context
mnt_ns_release() drops the last passive…
In the Linux kernel, the following vulnerability has been resolved:
namespace: look at the topmost mount for a mount namespace file
attach_recursive_mnt() preallocates a mountpoint for…
In the Linux kernel, the following vulnerability has been resolved:
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
open_tree(OPEN_TREE_NAMESPACE) creates a new mount…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check a recursive bind mount for mount namespace loops
do_loopback() refuses to bind mount the file of a…
In the Linux kernel, the following vulnerability has been resolved:
namespace: check a submount for references right before unmounting it
shrink_submounts() and mark_mounts_for_expiry()…
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description…
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to…
In the Linux kernel, the following vulnerability has been resolved:
namespace: keep the lock on a mount that a propagated copy is moved beneath
attach_recursive_mnt() transfers…
In the Linux kernel, the following vulnerability has been resolved:
namespace: handle mount locking for automounts correctly
If mounts are propagated across user namespaces,…
In the Linux kernel, the following vulnerability has been resolved:
namespace: never expire a locked mount
Locked mounts are special. They protect the underlying files and
directories…
In the Linux kernel, the following vulnerability has been resolved:
namespace: refuse an automount below a mount that is in no namespace
It's possible to add autmounts even when the…
In the Linux kernel, the following vulnerability has been resolved:
namei: don't reveal overmounted entries in refwalk
In rcuwalk the dentry is validated before it is accepted.…
In the Linux kernel, the following vulnerability has been resolved:
namespace: unhash a dentry before detaching the mounts on it
unlink(), rmdir() and rename() remove the entry from the…
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix the program leak when XDP is replaced
We need to release the reference on the old BPF prog, whether
we…
In the Linux kernel, the following vulnerability has been resolved:
cxgb4/ch_ktls: disable softirqs around tid_list erases
chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the…
In the Linux kernel, the following vulnerability has been resolved:
amt: send the relay's General Query directly from the receive path
An skb queued in a qdisc can outlive the tunnel it…
In the Linux kernel, the following vulnerability has been resolved:
net/sched: em_text: reject unterminated algo before autoload
This is a follow-up to commit 9c572a83037a ("net/sched:…
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Free the BO cache size list on teardown
vc4_bo_cache_destroy() purges the cached BOs but never frees the…
In the Linux kernel, the following vulnerability has been resolved:
gpio: exar: initialize the ID before registering its cleanup
devm_add_action_or_reset() invokes the cleanup action…
Brak pełnej oceny
CVSSNieustaloneEPSS 0,17 %
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 5.11.2026, 11:02 UTC – 5.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.