CVE-2019-18885

CVE-2019-18885 CVE-2019-18885 bobfuzzer أعضاء الفريق معلومات نظرة عامة الهدف إعادة الإنتاج أسباب الخطأ عرض المصحح سجلات KASAN شكر وتقدير bobfuzzer فريق مشروع في BoB المعروف أيضًا باسم Best of the Best، جمهورية كوريا. [email protected] اكتشاف الأخطاء في وحدات نظام الملفات لنواة لينكس أعضاء...

EUVD-2026-66573

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

kernel-sanitizers

Санитайзеры ядра Linux Примечание: большинство санитайзеров поддерживается в репозитории ядра Linux и здесь не размещено. Этот репозиторий содержит информацию и прототипы, не входящие в дерево исходных кодов ядра, для KASAN, UBSAN, KCSAN, KFENCE, KMSAN и KTSAN. Обратите внимание, что код KMSAN...

CVE-2026-80563

CVE-2026-80563 is a use-after-free in the Linux kernel's gpio-sloppy-logic-analyzer platform driver. The trigger debugfs file's trigger_write() handler dereferences a per-device structure allocated via devm_kzalloc(). Because the file was created with debugfs_create_file_unsafe(), the full_proxy ...

CVE-2026-74743

CVE-2026-74743 affects the Linux kernel's macvlan network driver. Macvlan devices inherit hard_header_len from the underlying device during initialization but leave needed_headroom and needed_tailroom set to zero. When the lower device requires extra headroom or tailroom (e.g., macsec , ipsec , w...

CVE-2026-74743 macvlan: inherit needed_headroom and needed_tailroom from lowerdev

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

K000163099: Linux kernel vulnerability CVE-2026-53253

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098892)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098892 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

CVE-2020-0423

Un grande grazie a tutte le altre persone che fanno ricerca sulla sicurezza e pubblicano il proprio lavoro, permettendo ad altri di imparare e di fare ricerca indipendente. Risorse: Articolo originale sull'exploit via longterm.io: https://www.longterm.io/cve-2020-0423.html Repo dell'utente Github...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bcm: Fixed a UAF in bcmprocshow. Bug: KASAN: A “slab-use-after-free” issue occurred in bcmprocshow+0x969/0xa80. A size 8 byte read was performed at address ffff888155846230 by the task cat/7862. CPU: 1; PID: 7862; Comm: cat; Not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed the issue “KASAN: slab-use-after-free Read in ibdevicerename”. Call Trace: dumpstack: lib/dumpstack.c:94 inline dumpstacklvl+0x116/0x1f0: lib/dumpstack.c:120 printaddressdescription: mm/kasan/report.c:408 inline...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fstcardinfo is deallocated in fstremoveone. However, the fsttxtask or fstinttask may still be running ...

CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

EUVD-2026-64576

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

CVE-2026-74635 is an out-of-bounds read in the Linux kernel's fbdev subsystem, specifically in bit_cursor() (drivers/video/fbdev/core/bitblit.c). The function indexes font glyph data using a value from the screen buffer without bounds-checking it against the font's glyph count. A local user can t...

EUVD-2026-64567

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

CVE-2026-74628

CVE-2026-74628 is a use-after-free in the Linux kernel's net/x25 (X.25 protocol) subsystem. The root cause is that x25 timers are armed with mod_timer() and cancelled with timer_delete(), meaning a pending timer holds no reference on the socket. Because x25_heartbeat_expiry() rearms unconditional...