Loading story…
A security review of malcontent 0.14.0, the GNOME parental control system maintained in the upstream GitLab project, identified a local denial-of-service vulnerability tracked as CVE-2026-44931. The flaw affects the newly introduced RecordUsage D-Bus method in malcontent-timerd, which can be abused by arbitrary local users to create unbounded records under /var/lib/malcontent-timerd and gradually fill /var until disk space is exhausted.
SUSE said upstream confirmed the issue but had not released a fix at the time of publication and did not continue coordinated disclosure discussions. The advisory recommends limiting the vulnerable method to local active sessions and enforcing per-user caps on usage entries as mitigations until a patch is available.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-11, the SUSE Security Team published details of CVE-2026-44931, a local denial-of-service issue in malcontent 0.14.0 that lets local users exhaust disk space via the RecordUsage D-Bus method in malcontent-timerd. The disclosure states upstream confirmed the issue, but no upstream fix was available at publication time.
A GitLab repository for Philip Withnall's malcontent project is referenced with a publication date of 2019-02-26, indicating the project was publicly present by that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LACT version 0.10.0 contains two local vulnerabilities affecting its root-privileged GPU-control daemon. **CVE-2026-75037** is a Polkit authorization bypass: the daemon authenticated clients by PID alone, allowing an eligible local user to win a PID race and add profile-hook scripts that the daemon would execute as root. The issue was compounded by related UID-handling behavior in `zbus_polkit`. **CVE-2026-75038** affects LACT's unauthenticated debug-snapshot API, which used predictable names for files written under `/tmp`. The condition could permit local denial of service and, on insufficiently hardened systems, permission-related information exposure or file-clobbering attacks; upstream changed snapshot creation from `File::create` to `File::create_new` to prevent overwriting an existing path. Upstream remediated both flaws in LACT 0.10.1; administrators should upgrade and restrict untrusted local access to affected systems until patched.
Sep 2, 2026
Red Hat disclosed two **Important** Linux kernel vulnerabilities in the SMB client’s `cifsacl` handling that can be triggered by a malicious SMB server and lead to memory corruption. **`CVE-2026-31709`** affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of **7.8**. A second flaw, **`CVE-2026-46195`**, affects **32-bit** Red Hat Enterprise Linux systems and stems from a crafted `dacloffset` value that can trigger pointer wrap during `chmod` or `chown` operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it **7.5**, and mapped it to **`CWE-787`**, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the `cifs` kernel module as a mitigation.
Aug 25, 2026
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026