CVE-2026-31477 addresses memory leaks and a NULL pointer dereference in the smb2_lock() function of the Linux kernel's ksmbd component. The vulnerability involves improper error handling after detaching smb_lock from the lock list, leading to resource leaks and potential kernel crashes. The issue was identified through call-graph analysis and fixed by improving cleanup and error propagation logic.
CVE-2026-31476 is a vulnerability in the Linux kernel's ksmbd component where a failed multichannel session binding request with a wrong password can cause an active session to be invalidated (DoS). The flaw occurs because the error path incorrectly expires a session belonging to another connection's user. This issue has been fixed by skipping session expiration when the binding attempt fails, preventing denial of service.
CVE-2026-31475 addresses a double free vulnerability in the Linux kernel's ASoC sma1307 driver. The issue arises from improper manual freeing of device-managed memory allocated with devm_kzalloc(), which leads to a double free when the device resource management later releases the same memory. This flaw has been fixed by removing the manual kfree() calls and relying on devres to handle cleanup.
A vulnerability in the Linux kernel IPTFS implementation allows crafted ESP packets with malformed inner IPv4 headers to cause an infinite loop in softirq context. This occurs due to missing validation of the inner IPv4 header length fields in decrypted IPTFS payloads, leading to a non-advancing data offset and a never-ending loop. The issue has been resolved by adding validation checks on the inner IPv4 packet total length and header length fields.
A high-severity vulnerability (CVE-2026-31471) in the Linux kernel's xfrm iptfs component involves improper handling of mode_data during clone setup. If memory allocation for the reorder window fails, mode_data points to freed memory, leading to potential use-after-free conditions during state destruction. This flaw has been resolved by ensuring mode_data is only published after successful allocation, preventing invalid memory access.
CVE-2026-31467 is a high-severity vulnerability in the Linux kernel's erofs filesystem code. It involves the bio completion path calling vm_map_ram() with GFP_KERNEL in process context, which can cause a deadlock due to memory swapping I/O under low memory conditions. The issue arises because the bio completion path does not use GFP_NOIO, leading to potential hangs in submit_bio_wait. The vulnerability has been resolved by adding GFP_NOIO in the bio completion path to prevent this deadlock scenario.
CVE-2026-31465 addresses a Linux kernel issue where sync operations on filesystems without data integrity guarantees (such as fuse) could cause system hangs during suspend-to-RAM. The fix introduces a superblock flag to avoid blocking on flusher threads during sync, preventing hangs caused by waiting on writeback completion in these filesystems.
CVE-2026-31463 is a critical vulnerability in the Linux kernel's iomap subsystem. It involves invalid folio access when the inode block size (i_blkbits) differs from the I/O granularity. This flaw can cause improper handling of folios during I/O operations, potentially leading to memory corruption or system instability. The issue arises because the current code does not invalidate the current folio context correctly in certain cases, allowing the I/O helper to finish reads on folios it should no longer own. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector and no required privileges or user interaction. No affected versions or patch information are explicitly provided in the data.
A memory leak and potential NULL pointer dereference vulnerability in the Linux kernel's DAMON_SYSFS subsystem was fixed. The issue occurs when damon_sysfs_new_test_ctx() fails during damon_sysfs_commit_input(), causing param_ctx to leak due to skipped cleanup. This can lead to memory leaks and NULL pointer dereferences when a privileged user performs incorrect control sequences.
A vulnerability in the Linux kernel's DAMON sysfs interface allows a NULL pointer dereference when the number of contexts (contexts->nr) is set to zero while DAMON is running. This occurs because certain functions are called without checking if contexts->nr is zero, leading to dereferencing contexts_arr[0].
A vulnerability in the Linux kernel's memory management subsystem (DAMON) could lead to the use of a partially updated or corrupted context object due to internal memory allocation failures during online parameter updates. This may cause unexpected behavior, including potential NULL pointer dereferences. The issue has been addressed by introducing a mechanism to detect and avoid using corrupted contexts.
CVE-2026-31444 is a critical vulnerability in the Linux kernel's ksmbd component involving use-after-free and NULL pointer dereference issues in the smb_grant_oplock() function. The flaw arises from improper handling of the oplock publication sequence, which can lead to dereferencing freed memory or NULL pointers during concurrent operations. The vulnerability has been fixed by restructuring the publication sequence to ensure safe memory handling and eliminating failure paths after publication.
A vulnerability in the Linux kernel's dmaengine xilinx xdma driver related to improper error handling during regmap initialization has been fixed. The function devm_regmap_init_mmio returns an ERR_PTR() on error, but the code incorrectly checked for NULL and mishandled the error code. This flaw has been corrected to properly check and handle the error pointer and message.
A NULL pointer dereference vulnerability in the Linux kernel's netfs_unbuffered_write() function was fixed. The issue occurs when a write subrequest marked for retry calls a NULL prepare_write operation, leading to a kernel crash. This affects filesystems like 9P that do not set the prepare_write operation. The fix skips the NULL call and reissues the write subrequest properly.
CVE-2026-31434 is a memory leak vulnerability in the Linux kernel's btrfs filesystem. The issue arises because when freeing elements of space_info->sub_group[], the function check_removing_space_info() does not properly call btrfs_sysfs_remove_space_info(), resulting in leaked kobject name memory. This leak is detectable with the kernel's kmemleak debugging feature and occurs in specific Linux kernel versions.
CVE-2026-6356 is a critical vulnerability in the Augmentt web application version 1.0 that allows standard users to escalate their privileges to super administrator level via parameter manipulation. This flaw enables unauthorized access and modification of sensitive information.
CVE-2026-6355 is an improper access control vulnerability in the Augmentt web application that allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This can result in unauthorized disclosure and modification of tenant-specific information. The vulnerability affects version 1.0 of Augmentt and has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
CVE-2026-41651 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in PackageKit versions 1.0.2 through 1.3.4. It allows a local unprivileged user to install arbitrary RPM packages as root without authentication, leading to local privilege escalation. The flaw arises from improper handling of transaction flags during package installation, enabling an attacker to overwrite flags after authorization but before execution. This vulnerability is patched in PackageKit version 1.3.5.
This update for erlang fixes the following issues:
Security issues fixed:
- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote
arbitrary reads/writes (bsc#1258663).
- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request
smuggling (bsc#1259687).
- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path
traversal (bsc#1259681).
- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service
(bsc#1259682).
- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure
(bsc#1261734).
Other updates and bugfixes:
- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).
CVE-2026-31433 is a high-severity vulnerability in the Linux kernel's ksmbd component. It involves a potential out-of-bounds write in the get_file_all_info() function when handling compound SMB requests that include QUERY_DIRECTORY and QUERY_INFO commands. The flaw arises from missing validation of the client-provided OutputBufferLength, which can lead to buffer overflow or memory corruption during UTF-16 conversion of filenames. This issue affects Linux kernel versions 5.15.145 and 6.1.71.