CVE-2026-93118

A flaw was found in the Linux kernel's USB gadget driver for Aspeed UDC. During the device initialization process, a failure to allocate a Direct Memory Access DMA buffer is not properly handled. This can lead to the driver attempting to use an invalid memory address, potentially causing a system...

CVE-2026-98486

A flaw was found in the Linux kernel's Amazon Elastic Network Adapter ENA driver. When the driver encounters an error during device initialization, it fails to release an allocated Direct Memory Access DMA buffer. A local user capable of triggering repeated device probe failures could exploit thi...

SUSE CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

DEBIAN-CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

UBUNTU-CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

EUVD-2026-103815

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.17.3 to 6.18 and version 6.18 have security vulnerabilities. These vulnerabilities stem from an error in the macballoc function, where the Tx and Rx buffers that have been allocated are not promptly stored in bp-queues0. As a result, during error handling, these...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck If due to a memory allocation failure mockchain returns NULL, it is passed to dmafenceenableswsignaling resulting in NULL pointer dereference there. Call...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot caused KMSAN to complain about accessing an uninitialized value within the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alaudatransport+0x462/0x57f0...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fixed the issue of double-fetching of hwcmsgid from the DMA buffer. In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and checked for validity. Then, manahwchandleresp rereads the same...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: udmabuf: Set the DMA mask for the udmabuf device v2 If the DMA mask is not set explicitly, the following warning occurs when the user space attempts to access the dma-buf via the CPU, as reported by syzbot: WARNING: CPU: 1 PID...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free. References to i915requests may be trapped by the user space within a syncfile or dmabuf dma-resv and held indefinitely across different processes. To counte...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fix BUGON in probe function The snddmabuffer.bytes field now contains the aligned size, which this sndBUGON did not account for, resulting in the following: 9.625915 ------------ cut here ------------ 9.633440...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fixed an issue where the CMA heap fault handler made a mistake in calculating the boundary. Until the VMDONTEXPAND flag was added in commit 1c1914d6e8c6 “dma-buf: heaps: Don’t track CMA dma-buf pages under RssFile...

Astra Linux – vulnerability in linux-6.1, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating numfences smpstoremb inserts a memory barrier after performing the store operation. This differs from what the comment originally intended; thus, a null pointer dereference may occur...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dmabufunpin in failure path In ibumemdmabufgetpinnedwithdmadevice, the call to ibumemdmabufmappages can fail. If this occurs, the dmabuf is immediately unpinned but the umemdmabuf-pinned flag remains set...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: The Zero SFP DMA buffer is not zeroed in FRU/I2C bsg handlers. The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte buffer, which is obtained through dmapoolalloc. This buffer does not zero...

AZL-108149 CVE-2026-98429 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before freeir...

DEBIAN-CVE-2026-98429

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before freeir...