CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: xsk: Reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: xsk: fixed a buffer leak in xskdropskb for AFXDP multi-buffer Tx This patch is inspired by the work from sashiko. It states that when an overflow occurs, the address of cq to be published is invalid. In fact, the more serious iss...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the function skbAppendPageFrags should no longer check the pfmemalloc status. The skbAppendPageFrags function is currently used by the afunix and udp.sendpage implementations. In commit 326140063946 “TCP: TX...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel before version 4.8, the usbparseendpoint function in drivers/usb/core/config.c did not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed a race condition between direct IO writes and fsync operations when using the same file descriptor. If we have two threads that use the same file descriptor, and one of them performs direct IO writes while the other...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: xsk: The issue of draining continuations after an overflow occurred in xskbuildskb has been fixed. The logic for handling multiple buffers in the generic xmit path was also corrected. This logic was problematic when packets were...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly freeing the struct axidmacdesc object. Use axidmacfreedesc to properly free the descriptor at the failure point when calling axidmacallocdesc in axidmacprepperipheraldmavec...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count The atadevconfigcpr function takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255. This number is then processe...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fixed NULL pointer dereferencing in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. The fcpfindfcinterface function currently selects the first...

Vulnerability of RDMA/iwcm components of the Linux operating system, allowing a hacker to cause a service failure

The vulnerability of RDMA/iwcm components in Linux operating systems is related to the multiple release of the same resource or descriptor. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

JLSEC-2026-1367

Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fdrenumber function where the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102033 advisory. In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102018)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102018 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated...

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the...

OESA-2026-3464 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Handling of Exceptional Conditions vulnerabili...

OESA-2026-3463 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Handling of Exceptional Conditions vulnerabili...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the JsonToGrpcGatewayFilterFactory process, which permits arbitrary Spring Resource locations to be specified for proto descriptor definitions. An attacker can access internal files or perform...

vim: Vim: Stack Buffer Overflow via unbounded socket connections

A flaw was found in Vim. The socket server backend accepts an unbounded number of client connections, causing file descriptors to overflow internal data structures. A local process able to connect to the server socket can exploit this to corrupt stack memory or terminate the Vim server. This can...

GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...