Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from inconsistent sizes of the jack input/output descriptor arrays in the midi2 USB gadget. This could lead to out-of-bound access when configuring a large number of jacks using configfs...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In usb: gadget: ftcm, the deadlock in usbgmaketpg has been fixed. usbgmaketpg held a deplock while calling configfsdependitemunlocked, which acquired the configfs root inode lock when operating across subsystems. This created a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint – Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed operation could lead to a NULL pointer dereference when the driver directory is removed before the operation completes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint – Fix for handling the configfs group list head The use of listdel on the epfgroup field of struct pciepfdriver in pciepfremovecfs is incorrect. This field is a list head, not a list entry. This listdel call trigger...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fixed recursive locking in configfsopenfile. In flushwritebuffer, the variable &p-fragsem is acquired, and then the loaded store function is called—specifically, targetcoreitemdbrootstore. This function calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fsubset: Fixed an unbalanced reference count in gethfree. gethalloc increments the reference count, but gethfree fails to decrement it. This causes issues when configuring attributes via configfs after unlinking the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Protect RNDIS options with a mutex The class/subclass/protocol options are susceptible to race conditions, as they can be accessed concurrently through configfs. A mutex should be used to protect these option...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint: pci-epf-vntb: Remove duplicate resource teardown The epfntbepcdestroy function duplicates the teardown that the caller is supposed to perform later. This leads to an error when .allowlink fails, or when .droplink i...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: Avoid scheduling the deletion of associations twice. When forcibly shutting down a port via the configfs interface, nvmetportsubsysdroplink first calls nvmetportdelctrls, and then nvmetdisableport. Both functions will...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: Fixed a use-after-free in compositedevcleanup. 1. In func configfscompositebind - compositeosdescreqprepare: If kmalloc fails, the pointer cdev-osdescreq will be freed but will not be set to NULL. As a result, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-90184

A flaw was found in the Linux kernel's nullblk module. A race condition exists where configfs attribute updates can occur concurrently with the nullblk device setup. This lack of synchronization can lead to incorrect device configuration, resulting in a system crash Denial of Service or failure t...

CVE-2026-90189

A flaw was found in the Linux kernel's nullblk component. A race condition can occur when the configfs subsystem is registered before default devices are created. This allows a local attacker, by performing a specific sequence of operations, to trigger a Use-After-Free UAF vulnerability. This cou...

CVE-2026-90185

A flaw was found in the Linux kernel's nullblk module. This vulnerability occurs because concurrent operations on configfs attributes are not properly synchronized. A local user could exploit this timing issue to modify data during device setup, leading to an out-of-bounds memory access. This cou...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy The string ‘s’ provided by the user space could easily have a length of zero. If this is left unchecked, it will first result in an OOB read in the form of if str0 - ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nullblk: Always check the queue mode setting from configfs. Make sure to check the device queue mode in the nullvalidateconf function, and return an error for NULLQRQ since we do not allow legacy I/O paths. Without this patch, we...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779434490)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779434490 advisory. - In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs,unregistersubsystem When...

SUSE CVE-2026-97949

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfsgetconfigitem treats a hashed dentry as proof that sd-selement is a live configitem. configfsrmdir breaks that: simplermdir leaves the dentry hashed, the last...

SUSE CVE-2026-97950

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...