Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fixed the recursive pcilockrescanremove locking mechanism in EEH event handling. The recent commit 1010b4c012b0 “powerpc/eeh: Making the EEH driver’s device hotplug safe” restructured the EEH driver to improve...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-42017

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-42017

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

EUVD-2026-49568

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-42017 Privilege escalation via JFrog Worker event token exposure

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-10664

The nRF70 Wi-Fi driver's power-save event handler nrfwifieventprocgetpowersaveinfo in drivers/wifi/nrfwifi/src/wifimgmt.c copied TWT Target Wake Time flow entries from an nrfwifiumaceventpowersaveinfo event into the fixed-size twtflowsWIFIMAXTWTFLOWS 8-element array of a caller-supplied struct...

CVE-2025-58146 XAPI UTF-8 string handling

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but...

EUVD-2026-36322

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-53241

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events by copying an incoming struct sndseqevent into a stack temporary, rewriting source and destination, and dispatching the temporary to...

UBUNTU-CVE-2026-53241

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events by copying an incoming struct sndseqevent into a stack temporary, rewriting source and destination, and dispatching the temporary to...

CVE-2026-53241

Summary: CVE-2026-53241 affects the Linux kernel ALSA sequencer dummy port. A local attacker could trigger a stack overread when handling Universal MIDI Packet (UMP) events due to copying a UMP-sized packet into legacy stack storage, leaving the UMP data truncated. The root cause is the dummy cli...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel through version 5.9.1, as used with Xen up to version 4.14.x. The file drivers/xen/events/eventsbase.c allows for the removal of event channels during the event-handling loop a race condition. This can lead to a use-after-free or NULL pointer...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the node event handling process. An attacker can gain unauthorized access to restricted exec lifecycle events by sending crafted node.event messages from a paired...

CVE-2026-53816 OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node

OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway,...

PT-2026-48746

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18 Description Insufficient provenance validation in node event handling allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send...

CVE-2026-46181

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4srqevent Sashiko points out the radixtree itself is RCU safe, but nothing ever frees the mlx4srq struct with RCU, and it isn't even accessed within the RCU critical section. It also will crash...

CVE-2026-45904

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: fix recursive pcilockrescanremove locking in EEH event handling The recent commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" restructured the EEH driver to improve synchronization with the PCI...

CVE-2026-45904 powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: fix recursive pcilockrescanremove locking in EEH event handling The recent commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" restructured the EEH driver to improve synchronization with the PCI...