CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178

ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

GHSA-RRXG-G2PF-6HH4 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

Missing Authentication for Critical Function

Overview esphome-device-builder is an ESPHome Device Builder Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the DashboardSettings.parseargs process when only legacy environment variables are set. An...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded devices. The dev pointer received as an argument in the inilluminanceperiodavailableshow function refers to the device embedded within the IIO device, not the i2c clien...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: logitech-hidpp: Fixed a kernel crash when the USB connection is disconnected. The function hidppconnectevent experiences four times-of-check versus-time-of-use TOCTOU races when it races with itself. hidppconnectevent...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: nbd: Fixed an issue where the process got hung during disconnection of a device. In our tests, “qemu-nbd” triggered a hung process: INFO: Task “qemu-nbd”: 11445 is blocked for more than 368 seconds. Not tainted...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access to inputdev under a mutex It is possible when using ASoC that the inputdev is not properly registered while calling sndjackreport, which can lead to a NULL pointer derefrence. To prevent this type of serialized...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds acces...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Guard flow control updates with globaltxfc in buffer switching The function mvpp2bmswitchbuffers mvpp2bmpoolupdateprivfc when switching between per-cpu and shared buffer pool modes. This function programs the CM3 flow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drbd: Added krefget to the handlewriteconflicts function. With “two-primaries” enabled, DRBD attempts to detect “concurrent” writes and handle write conflicts. This ensures that even if you write to the same sector simultaneously...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A use-after-free vulnerability was discovered in the siano smsusb module within the Linux kernel. The bug occurs during device initialization, when the siano device is plugged in. This flaw allows a local user to crash the system, resulting in a denial-of-service condition...