EUVD-2026-82278

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

CVE-2026-93170

CVE-2026-93170 is a race condition in the Linux kernel's dmaengine: xilinx_dma driver, affecting the AXIDMA and MCDMA interrupt handlers. When multiple descriptors are queued, an interrupt after partial completion causes the channel to be incorrectly marked idle and start_transfer() to be called ...

CVE-2026-93041

CVE-2026-93041 is a race condition in the Linux kernel's dw-edma (DesignWare eDMA) DMA engine driver. The function dw_edma_abort_interrupt() drops vc.lock before updating the request and status fields. In that window, issue_pending() can acquire the lock, observe the stale busy state, and skip st...

EUVD-2026-82101

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

CVE-2026-92480

CVE-2026-92480 affects the Linux kernel in the scsi ufs core subsystem. Two related out-of-bounds read issues exist in string descriptor handling: first, utf16s_to_utf8s() expects a count of UTF-16 code units but receives a byte count, which can cause it to read beyond the descriptor buffer; seco...

CVE-2026-90367

CVE-2026-90367 is a race condition in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7996 hardware. The root cause is that mt7996_mac_reset_work() parked the TX worker and disabled RX/TX NAPIs before taking dev->mt76.mutex, while __mt76_set_channel() toggles the same worker ...

CVE-2026-90233 nvme-pci: release descriptor pools on probe failure

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-633r-hq9m-c4ff. This link is maintained to preserve external references. Original Description vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects,...

CVE-2026-92382

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-92949 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...

CVE-2026-92949

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. An attacker can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host o...

CVE-2026-93041: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...

CVE-2026-90382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-93170: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829

The Optimole WordPress plugin (versions 4.2.3-4.2.11 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly escape user-supplied values when building an image tag attribute. Specifically, the flaw involves the srcset descriptor parameter , which allows unauthenticated u...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/msm: Another leak in the submit error path has been fixed. putunusedfd does not free the allocated file if we have already performed fdinstall. Therefore, we also need to free the syncfile. Patchwork:...

Astra Linux – Vulnerability in OpenCV

A issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in the modules/objdetect/src/hog.cpp module...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fixed a potential use-after-free issue in irqprocessworklist. The listforeachentry Safe function was used to allow iterating through the list and deleting entries during the iteration process. The descriptors are...