https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-90042.htmlhttps://patchthecve.com/cve/CVE-2026-90042.htmlWed, 21 Oct 2026 13:20:35 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmallochttps://patchthecve.com/cve/CVE-2026-89990.htmlhttps://patchthecve.com/cve/CVE-2026-89990.htmlMon, 19 Oct 2026 09:18:46 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutehttps://patchthecve.com/cve/CVE-2026-89657.htmlhttps://patchthecve.com/cve/CVE-2026-89657.htmlMon, 19 Oct 2026 09:18:03 +0000HIGH 7.5: In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent ihttps://patchthecve.com/cve/CVE-2026-89655.htmlhttps://patchthecve.com/cve/CVE-2026-89655.htmlMon, 19 Oct 2026 09:18:03 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire https://patchthecve.com/cve/CVE-2026-89654.htmlhttps://patchthecve.com/cve/CVE-2026-89654.htmlWed, 21 Oct 2026 13:20:18 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from mhttps://patchthecve.com/cve/CVE-2026-89653.htmlhttps://patchthecve.com/cve/CVE-2026-89653.htmlMon, 19 Oct 2026 09:18:02 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol nameshttps://patchthecve.com/cve/CVE-2026-89652.htmlhttps://patchthecve.com/cve/CVE-2026-89652.htmlMon, 19 Oct 2026 09:18:02 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_https://patchthecve.com/cve/CVE-2026-89651.htmlhttps://patchthecve.com/cve/CVE-2026-89651.htmlMon, 19 Oct 2026 09:18:02 +0000CRITICAL 9.8: In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte sthttps://patchthecve.com/cve/CVE-2026-89650.htmlhttps://patchthecve.com/cve/CVE-2026-89650.htmlMon, 19 Oct 2026 09:18:02 +0000CRITICAL 9.1: In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without firhttps://patchthecve.com/cve/CVE-2026-89649.htmlhttps://patchthecve.com/cve/CVE-2026-89649.htmlMon, 19 Oct 2026 09:18:02 +0000CRITICAL 9.1: In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value https://patchthecve.com/cve/CVE-2026-89648.htmlhttps://patchthecve.com/cve/CVE-2026-89648.htmlWed, 21 Oct 2026 13:20:15 +0000HIGH 7.5: In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len wihttps://patchthecve.com/cve/CVE-2026-89647.htmlhttps://patchthecve.com/cve/CVE-2026-89647.htmlWed, 21 Oct 2026 13:20:14 +0000HIGH 7.5: In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. https://patchthecve.com/cve/CVE-2026-89646.htmlhttps://patchthecve.com/cve/CVE-2026-89646.htmlMon, 19 Oct 2026 09:18:01 +0000HIGH 7.8: In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and attaches the snap_context https://patchthecve.com/cve/CVE-2026-39979.htmlhttps://patchthecve.com/cve/CVE-2026-39979.htmlMon, 26 Oct 2026 19:36:22 +0000MEDIUM 6.5: jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL ter