[SECURITY] Fedora 42 Update: qt6-qtserialbus-6.9.3-1.fc42

Qt Serial Bus API provides classes and functions to access the various industrial serial buses and protocols, such as CAN, ModBus, and others...

SUSE CVE-2025-40020

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

DEBIAN-CVE-2025-40020

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

EUVD-2025-35839

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

CVE-2025-40020 can: peak_usb: fix shift-out-of-bounds issue

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987522)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987522 advisory. In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix potential CAN frame reception race in isotprcv When receiving a CAN frame the...

SUSE CVE-2025-39987

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACKET...

CVE-2025-39988

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the...

CVE-2025-39985

In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACKE...

CVE-2025-39987

The CVE-2025-39987 entry concerns the Linux kernel hi311x CAN/PCI driver stack and PF_PACKET handling. The vulnerability arises when sun4i_can does not populate net_device_ops -> ndo_change_mtu(), allowing an attacker to set an invalid MTU (e.g., ip link set can0 mtu 9999). A crafted PF_PACKET...

CVE-2025-39985

In CVE-2025-39985, the Linux kernel mcba_usb driver fails to populate net_device_ops->ndo_change_mtu(), allowing an attacker using PF_PACKET (ETH_P_CANXL) to set an invalid MTU (e.g., can0 mtu 9999). The PF_PACKET framework only verifies skb->len against the interface MTU, so a crafted CAN ...

EUVD-2010-2963

Malware in sbrugna...

EUVD-2010-3852

Malware in sbrugna...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414581)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414581 advisory. .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-389429)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-389429 advisory. In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcmconnect...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987190)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987190 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: Skip non-Ethernet packets Currently tcfskbmodact assumes that packets use...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-986797)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986797 advisory. In the Linux kernel, the following vulnerability has been resolved: can: afcan: fix NULL pointer dereference in canrxregister It causes NULL pointer dereference when...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-559572)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-559572 advisory. In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcantxhandler: fix use after free of skb canputechoskb will clone skb then free the sk...

EUVD-2023-32516

Malicious code in bioql PyPI...

CVE-2023-53523

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: fix time stamp counter initialization If the gsusb device driver is unloaded or unbound before the interface is shut down, the USB stack first calls the struct usbdriver::disconnect and then the struct...