Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh versions built with OpenSSL versions older than 3.0. The issue lies with the sshkdf function, which is responsible for key derivation. Due to inconsistent interpretation of return values, OpenSSL uses 0 to indicate failure, while libssh uses 0 for success. As a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: gpiolib: fixed invalid pointer access in debugfs. If the memory allocation in gpiolibseqstart fails, the s-private field remains uninitialized, and it may be dereferenced without proper checks in gpiolibseqstop. Initialize...

Astra Linux – Vulnerability in ffmpeg

A flaw was discovered in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Ensure that no dirty metadata is written back for a file system with errors. BUG During the development of a minor feature make sure that all btrfsbio::endio calls are performed in a task context, I noticed a crash in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Media: i2c: tc358743 – Fixed use-after-free bugs caused by an orphan timer in the probe. state-timer is a cyclic timer that schedules worki2cpoll and delayedworkenablehotplug, while rearming itself. Using timerdelete fails to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Account for failed debug initialization. When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. This fault condition should be...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: um: virtiouml: Fixed a use-after-free after putdevice in probe. When registervirtiodevice fails in virtioumlprobe, the code sets vudev-registered = 1, even though the device was not successfully registered. This can lead to...

SUSE CVE-2026-22693

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at t...

PT-2026-22924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel has an issue where romfs fill super does not check the return value of sb set blocksize. This can lead to a kernel BUG in folio set bh if a loop device's block size is s...

The vulnerability of the libxslt library, related to the pointer being set to an expired value, allows a malicious actor to trigger a service failure.

The vulnerability of the libxslt library is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2025-71081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the...

Linux Distros Unpatched Vulnerability : CVE-2025-68778

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from on...

The vulnerability of the apply_substitution function in the libarchive library allows a perpetrator to trigger a service failure.

The vulnerability of the applysubstitution function in the libarchive library is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-2552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ext4 implementation related to extended attribute handling. Specifically, a null pointer dereference can occur within the ext4 raw inode function if...

PT-2026-2674

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A security feature bypass exists in Windows Remote Assistance. This allows an unauthorized attacker to bypass a security feature locally. The issue involves a failure in a protection mechanis...

PT-2026-2602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to the ASoC Audio System on Chip STM32 SAI Serial Audio Interface driver. Specifically, the vulnerability involves a potential OF Open Firmware...

Linux Distros Unpatched Vulnerability : CVE-2025-68820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4rawinode If ext4getinodeloc fails e.g. if it...

PT-2026-2590

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The F2FS filesystem, when mounting filesystems with corrupted directory depth values, can experience issues with dentry cache invalidation during rename operations involving whiteouts...

PT-2026-2601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s IPv6 implementation within the rt6 get pcpu route function when operating under the PREEMPT RT kernel configuration. Specifically, after rt6 get pcpu...

MiracleLinux 9 : mod_http2-2.0.26-4.el9_6.1 (AXSA:2025-10820:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2025-10820:02 advisory. httpd: modproxyhttp2: untrusted input from a client causes an assertion to fail in the Apache modproxyhttp2 module CVE-2025-49630 Tenable has extracted the...