Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: Fixed the issue with VMBUGONPAGEPagePoisonedpage when unpoisoning memory. When I performed memory failure tests, the following panic occurred: Page dumped because: VMBUGONPAGEPagePoisonedpage. Kernel BUG at...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copythresh allocation failure The driver did not handle the failure of netdevallocskbip-align. If the allocation fails, dereferencing skb-protocol could lead to a NULL pointer dereference. This patch attempts t...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check the running state of GuC before deregistering an exec queue. During normal operation, a registered exec queue is disabled and deregistered through GuC. It is only freed after GuC confirms completion. However, if...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/atom: Check kcalloc for the WS buffer in amdgpuatomexecutetablelocked. kcalloc may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.wssize is set. This can lead to a potential NULL pointe...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Directly freeing partially initialized fsinfo in btrfscheckleakedroots If fsinfo-supercopy or fsinfo-superforcommit was allocated and failed in btrfsgettreesubvol, then there is no need to call btrfsfreefsinfo. Otherwise,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ice: iceadapter: The XArray entry created by xainsert is not released when iceadapternew fails. This results in subsequent insertions at the same index returning -EBUSY, potentially leading to NULL pointer dereferences. The...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdwutils: avoid NULL deref when devmkasprintf fails devmkasprintf may return NULL when memory allocation fails. However, the debug message prints cpus-dainame before checking it. Move the devdbg call after the NULL chec...

Astra Linux – Vulnerability in mbedtls

In Mbed TLS versions prior to 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uninitialized stack memory was used to construct the TLS Finished message. This could potentially lead to authentication bypasses, such as replay attacks...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: Returning NULL pointer in case of allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code “-ENOMEM”. However, the caller etmsetupaux only checks for a NULL pointer...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - media: v4l2-subdev: Fixed the issue with the check for allocation failure in v4l2subdevcallstatetry. The v4l2subdevcallstatetry macro uses v4l2subdevstatealloc to allocate a subdev state, but it does not check the returned...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not call kfree on devices managed by devres. Since the allocation of the driver’s main structure was changed to devmdrmdevalloc, the rdev is managed by devres, and we should not call kfree on it. This fix prevents...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only the newly added IRQ mapping when requestirq fails. The mlx5irqalloc function may inadvertently free the entire rmap, leading to a crash when other threads attempt to access it. This occurs when requestirq...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh versions built with OpenSSL versions older than 3.0. The issue lies with the sshkdf function, which is responsible for key derivation. Due to inconsistent interpretation of return values, OpenSSL uses 0 to indicate failure, while libssh uses 0 for success. As a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Ensure that no dirty metadata is written back for a file system with errors. BUG During the development of a minor feature make sure that all btrfsbio::endio calls are performed in a task context, I noticed a crash in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: um: virtiouml: Fixed a use-after-free after putdevice in probe. When registervirtiodevice fails in virtioumlprobe, the code sets vudev-registered = 1, even though the device was not successfully registered. This can lead to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Media: i2c: tc358743 – Fixed use-after-free bugs caused by an orphan timer in the probe. state-timer is a cyclic timer that schedules worki2cpoll and delayedworkenablehotplug, while rearming itself. Using timerdelete fails to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Account for failed debug initialization. When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. This fault condition should be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: gpiolib: fixed invalid pointer access in debugfs. If the memory allocation in gpiolibseqstart fails, the s-private field remains uninitialized, and it may be dereferenced without proper checks in gpiolibseqstop. Initialize...

Astra Linux – Vulnerability in ffmpeg

A flaw was discovered in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services a...

SUSE CVE-2026-22693

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at t...