Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: setpageextentmapped after readfolio in btrfscontexpand. While attempting to run the subpage block size tests, I encountered the following panic in generic/476: Assertion failed: PagePrivatepage && page-private, in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in pushnsh action The pushnsh action structure looks like this: OVSACTIONATTRPUSHNSHOVSKEYATTRNSHOVSNSHKEYATTRBASE,... The outermost OVSACTIONATTRPUSHNSH attribute is OK'ed by the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Apparmor: Fixed a side-effect bug in the use of the matchchar macro. The matchchar macro evaluates its character parameter multiple times when traversing differential encoding chains. When invoked with str++, the string pointe...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not skip expired elements during walking. There is an asymmetry between the commit/abort phase and the preparation phase if the following conditions are met: 1. “set” is a verdict map “1.2.3.4 : jump foo”...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallowed reading of the vsyscall page for copyfromkernelnofault When attempting to use copyfromkernelnofault to read the vsyscall page through a bpf program, the following oops was reported: BUG: Unable to handle a page...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: can: peakpci: peakpciremove: fixed UAF. When removing the peekpci module, referencing chan again after releasing dev can lead to UAF. This issue was fixed by delaying the release of dev. The following log indicates this issue:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed a null pointer access when the smcrreg pointer is NULL. In certain types of chips, such as VEGA20, reading the amdgpu regssmc file can lead to a null pointer access when the smcrreg pointer is NULL. Here are the...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-46242 — "Bad Epoll" This repo is a bad Epoll validat...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 GhostLock – Honor BVL-AN16 Exploit Research...

CVE-2026-74543

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

CVE-2026-74458 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74458

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74397

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

CVE-2026-74310

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

UBUNTU-CVE-2026-72407

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...

UBUNTU-CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

EUVD-2026-59507

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

CVE-2026-74331 firmware_loader: Fix recursive lock in device_cache_fw_images()

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fwpmnotify calls...

CVE-2026-72154

CVE-2026-72154 describes a Linux kernel vulnerability in the OpenRISC path related to jump_label SMP cache syncing. The issue arose from an OpenRISC-specific implementation that copied from arm64 and didn’t correctly handle icache invalidation on remote cores, which could leave stale static_key c...

PT-2026-72870

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc recvmsg oob takes a received oob message off recvmsg oobq and, if a response is needed, moves it onto the pending oobq tree. However, only the unlink from recvms...