apk package
chainguard/linux-gcp-6.18-bootc
pkg:apk/chainguard/linux-gcp-6.18-bootc
Vulnerabilities (101)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64298 | Hig | 7.1 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO | |
| CVE-2026-64297 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked. If the i | |
| CVE-2026-64296 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulate | |
| CVE-2026-64295 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dyn | |
| CVE-2026-64294 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against | |
| CVE-2026-64293 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr): if (!v | |
| CVE-2026-64292 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can | |
| CVE-2026-64291 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively | |
| CVE-2026-64290 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault g | |
| CVE-2026-64268 | Cri | 9.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accum | |
| CVE-2026-64267 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid payload length with: size - sizeof(outarg) != outarg.count * sizeof(u64) On 32-bit kernels, size_t is also 32 bits, | |
| CVE-2026-64266 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg f | |
| CVE-2026-64265 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requ | |
| CVE-2026-64264 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number of bytes not copied as an unsigned residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit stores that | |
| CVE-2026-64263 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves entries that are available (these have no reqs attached) to the ent_in_userspace list. ent_list_request_expired() checks | |
| CVE-2026-64262 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work with tw.cancel set (PF_EXITING, PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context), fuse_uring_send_in_task() | |
| CVE-2026-64261 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction | |
| CVE-2026-64260 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the valu | |
| CVE-2026-64259 | Hig | 7.8 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uri | |
| CVE-2026-64258 | Med | 5.5 | < 6.18.44-r0 | 6.18.44-r0 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NUL |
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked. If the i
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulate
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dyn
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr): if (!v
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault g
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accum
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid payload length with: size - sizeof(outarg) != outarg.count * sizeof(u64) On 32-bit kernels, size_t is also 32 bits,
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg f
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requ
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number of bytes not copied as an unsigned residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit stores that
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves entries that are available (these have no reqs attached) to the ent_in_userspace list. ent_list_request_expired() checks
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work with tw.cancel set (PF_EXITING, PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context), fuse_uring_send_in_task()
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the valu
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uri
- affected < 6.18.44-r0fixed 6.18.44-r0
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NUL
Page 1 of 6