Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof vs ARRAYSIZE bug The “buf” pointer is an array of u16 values. This code should use ARRAYSIZE which is 256 instead of sizeof which is 512; otherwise, it may still go out of bounds...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpioid before using it as an array index WHY & HOW GPIOIDUNKNOWN -1 is not a valid value for an array index; thus, it must be validated beforehand. This fix addresses 5 OVERRUN issues reported by Coverity...

Astra Linux – vulnerability in dcmtk

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix use after free on platformdeviceregister errors x86androidtabletremove frees the pdevs array; therefore, it should not be used after calling x86androidtabletremove. When platformdeviceregist...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fixed warnings related to cancelsync on uninitialized workstructs. Betty reported encountering the following warning: 8.709131 T221 WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182 ... 8.713282 T221 Call trace:...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fixed a memory leak in the BO array when it is in a hung state. The BO array that is in a hung state is allocated separately using kzalloc in vc4savehangstate, but it is never freed using vc4freehangstate. Add the missin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Three issues in damonhotscore have been fixed due to improper handling of user-defined extreme zero or excessively high monitoring intervals. When the user sets the...

Astra Linux – vulnerability in php8.1, php7.3

In PHP versions: 8.1. prior to 8.1.34, 8.2. prior to 8.2.30, 8.3. prior to 8.3.29, 8.4. prior to 8.4.16, and 8.5. prior to 8.5.1, a heap buffer overflow occurs in arraymerge when the total number of elements in packed arrays exceeds 32-bit limits or HTMAXSIZE. This is caused by an integer overflo...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, verifier: Fix memory leak in array reallocation for stack state If an error NULL is returned by krealloc, callers of reallocarray were setting their allocation pointers to NULL; however, on error krealloc does not modify the...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsiccgupdatesetnewcamcmd The “cmd” variable can be controlled by the user via debugfs. This means that “newcam” can be as high as 255 while the size of the uc-updated array is...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: fix bulk flow accounting logic for host fairness In schcake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when...

Astra Linux – vulnerability in linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: use vmmtable as array in wilc struct Enabling KASAN and running some iperf tests raises some memory issues with vmmtable: BUG: KASAN: slab-out-of-bounds in wilcwlanhandletxq+0x6ac/0xdb4 Write of size 4 at addr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dm array: Rejects an array block whose value size is not the caller’s. arrayblockcheck can only compare the header against itself. Therefore, a block with a valuesize of 4 and a maxEntries of 1018 is internally consistent and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added an array index check for hdcp ddc access. Reason Coverity reported an OVERRUN warning. Do not check if the array index is valid. How Check that the msgid is valid and that the array index is valid...

Astra Linux – vulnerability in ffmpeg, ffmpeg5

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter libavfilter/affirequalizer.c due to a missing check on the return value of avmallocarray in the configinput function. An attacker could exploit this by tricking a victim into processing a crafted media file with the...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

CVE-2026-97394

The kin-openapi Go project (versions 0.136.0 through 0.143.0 ) contains a nil-pointer dereference vulnerability in the openapi3filter component. This occurs when the application processes OpenAPI 3.1 array schemas that lack the items keyword. During the decoding of application/x-www-form-urlencod...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...