NXP MCUXpresso MCUXpresso SDK buffer error vulnerability

Versions of the NXP MCUXpresso SDK prior to 2.13.0 contain a buffer error vulnerability. This vulnerability arises because USBDeviceCdcRndisSetCommand trusts informationBufferOffset provided by the host. A malicious USB host can send RNDIS SET messages containing OIDGENCURRENTPACKETFILTER or...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovecphysmergeable biovecphysmergeable is used by the request merge, DMA mapping, and integrity merge paths to determine whether two physically contiguous bvec segments can be coalesced into one...

AZL-108144 CVE-2026-98386 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memsetio to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory ha-iobase + reqqueoff, not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through...

CVE-2026-98386: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memsetio to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory ha-iobase + reqqueoff, not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through...

PT-2026-114365

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx SCSI driver where the qla2x00 alloc iocbs function uses a standard memset to clear the producer slot of the QLAFX00 request ring. Because the request ring...

CVE-2026-102073

A vulnerability exists in multiple APOGEE and TALON products, including APOGEE MBC (PPC), MEC (PPC), PXC Compact, PXC Modular, and TALON TC Compact/Modular across various BACnet and P2 Ethernet configurations. The root cause is an integer underflow (CWE-191) where the web service fails to properl...

EUVD-2026-98406

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: A WARN was issued during the deregmr operation for DM type. Memory regions of the DM type do not have an associated umem. In the flow from mlx5ibderegmr to mlx5freeprivdescs, the code incorrectly takes the wrong branch...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: Avoid scanning potential huge holes. When using devmrequestfreememregion and devmmemremappages to add ZONEDEVICE memory, if the end PFN of the requested free memory region is huge e.g., 0x400000000, then nodeendpfn...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: clk: imx93 – fixed a memory leak and the missing unwind goto in imx93clocksprobe. In the function probe, it returns directly without unregistered hws when an error occurs. This issue was fixed by adding goto unregisterhws; on...

CVE-2026-68268

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

CVE-2026-45204 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

CVE-2026-45204 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

CVE-2026-45204

A vulnerability exists in the GPU DDK where software running as a non-privileged user can conduct improper GPU system calls. This triggers out-of-bounds (OOB) memory access and a kernel null pointer dereference within the DmaTransfer function when pui64Address points to device memory. The null po...

CVE-2026-64377

A double free vulnerability exists in the Linux kernel's qcom-cpufreq-hw driver (Qualcomm CPU frequency hardware). The root cause is that qcom_cpufreq_hw_cpu_exit() calls kfree() on policy->driver_data, which points to memory allocated via devm_kzalloc() in probe(). For the first domain, this ...

CVE-2026-53371

A flaw was found in the Linux kernel's ionic Remote Direct Memory Access RDMA driver. A local user can exploit this vulnerability due to an unbounded read operation when displaying the nodedesc sysfs file. If the nodedesc field is not null-terminated, the system will read beyond its allocated...

Linux Distros Unpatched Vulnerability : CVE-2026-64131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private...

CVE-2025-43892: Buffer Over-read

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitti...

CVE-2026-58583

FluxInk formerly Sunia SPB Peripheral Color Management Driver TcnPeripheral64.sys 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/xe: Fixed a memory leak in xedmabufinitobj when allocation failure occurs. When drmgpuvmresvobjectalloc fails, the pre-allocated memory is not freed. Added a call to xebofreestorage before returning an error. xedmabufinito...