EUVD-2026-103573

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98613: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98755: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

PT-2026-116974

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc send ctl The stack-allocated struct vio vcc pkt was partially initialized, leaving the tag.stype env field uninitialized before being sent via ldc write, potentially leaking kernel...

Linux Distros Unpatched Vulnerability : CVE-2026-98755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from insufficient depth restrictions on the ownership relationship between BPF and local kptrs and Goto statements. The self-referencing local kptr types can form arbitrarily deep object chains, and the sa...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.12.113, 6.18.56, and 7.2.10 contain security vulnerabilities. These vulnerabilities stem from the viovcc structure used in vccsendctl, where the packet associated with the stack allocation is not fully initialized. As a result, the tag.stypeenv field is not...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.9 contains security vulnerabilities. These vulnerabilities stem from the gpiodesctolineinfo function, which returns early when attempting to retrieve GPIO chip protection information, and does not clear the info structure. This may lead to the leakage of kernel stack...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: 6lowpan: corrected an off-by-one error in the multicast context address compression process. The second memcpy in lowpaniphcmcastctxaddrcompress uses &data1 as the destination and &ipaddr-s6addr11 as the source. However, both...

Astra Linux – Vulnerability in Linux

In the file drivers/pci/hotplug/rpadlpar/sysfs.c within the Linux kernel up to version 5.11.8, the RPA PCI Hotplug driver suffers a user-tolerable buffer overflow when writing a new device name to the driver from user space. This allows user space to write data directly to the kernel stack frame...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fixed a possible incorrect match in nfosffind. nfosffind incorrectly returns true in case of a mismatch, which leads to copying uninitialized memory areas in nftosf. This can result in leaking stale kerne...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RISCV: Kernel mappings of the EFI page table must be synchronized before switching to the EFI page table. The EFI page table is initially created as a copy of the kernel page table. When VMAPSTACK is enabled, kernel stacks are...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/tm: Fixed corruption in user space r13. The commit cf13435b730a “powerpc/tm: Fixed corruption in user space r13” fixes a problem in treclaim, where a SLB miss can occur on threadstruct-ckpt regs, when SCRATCH0 is active a...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assumes a certain maximum size for the instructions being emulated. However, the actual size of these operations is determined separately in...

CVE-2026-19669 Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

CVE-2026-19669

The Zephyr RTOS is vulnerable to a kernel stack overflow due to unbounded variable-length arrays (VLAs) in the z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() functions within drivers/fuel_gauge/fuel_gauge_syscall_handlers.c. An attacker can provide an unvalidated len argument via...

CVE-2026-19669 Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

CVE-2026-19669 Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98201

A vulnerability exists in the Linux kernel within the compat path of the input_ff_effect_from_user() function. The issue arises because the function aliases a native struct ff_effect with a smaller struct ff_effect_compat and only copies the compat-sized prefix using copy_from_user(). Consequentl...