Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfs: Fix for writeback error handling The error handling in the writebackiter loop has been corrected. If an error occurs, writebackiter must be called again, with the error set to the actual error, so that the iteration sta...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fixed unbalanced locking in pcclocksettime. If getclockdesc succeeds, it calls fget for the fd of the clockid. It also acquires a read lock on clk-rwsem. Therefore, the error path should release the lock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed issues related to locking and validity checks for isoconn. sk-skstate indicates whether isopisk-conn is valid. Operations that check or update skstate and access conn should hold locksock; otherwise, they...

The vulnerability of the spidev.c component in the Linux operating system’s kernel, related to insufficient locking mechanisms, allows a malicious actor to trigger a service failure.

The vulnerability of the spidev.c component in the Linux operating system’s kernel is related to insufficient locking mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the RDMA/mlx5 component of the Linux operating system, which allows a hacker to trigger a service failure.

The vulnerability of the RDMA/mlx5 component of the Linux operating system is related to errors during thread locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

AZL-97329 CVE-2026-74733 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

UBUNTU-CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64544

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues: - in sevmigratefrom, when the destination K...

CVE-2026-74593

This CVE affects the Linux kernel 's sched_ext subsystem. The root cause is a lock ordering bug in scx_cgroup_lock(), which acquires scx_cgroup_ops_rwsem (write) before cgroup_lock(). This ordering can create a deadlock through kernfs when concurrent operations on cgroup rmdir and cpu.weight writ...

PT-2026-79619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vsock/virtio component where RX, TX, and event workers read their virtqueue before locking and checking the corresponding run flag. This occurs during device suspe...

CVE-2026-33047

Combodo iTop (a web-based IT service management tool) is affected by a permission bypass in versions prior to 3.2.3 . A user without write permissions can lock an object, which may disrupt other users' ability to modify that object. The CVSS 3.1 score is 4.3 (MEDIUM) , reflecting a low availabili...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047: Missing Authorization

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001466 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DF...

CVE-2026-74365

A flaw was found in the Linux kernel's NVDIMM Block Translation Table BTT subsystem. A race condition during BTT lane acquisition, caused by an invalid locking model, allows another task to bypass locking and concurrently use a BTT lane. This can lead to silent data corruption during BTT write...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking through the bridgeSpan baggage handling in bridge/opentracing/bridge.go. An attacker can crash the process by causing one goroutine to call Span.SetBaggageItem while another goroutine propagates correlation baggage from...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking through the bridgeSpan baggage handling in bridge/opentracing/bridge.go. An attacker can crash the process by causing one goroutine to call Span.SetBaggageItem while another goroutine propagates correlation baggage from...

Authorization Bypass Through User-Controlled Key

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the PATCH process. An attacker can overwrite identifier and version properties by sending crafted RFC 6902 JSON...

Improper Enforcement of Behavioral Workflow

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the handling of HTTP PUT requests against immutable aggregate types. An attacker can bypass optimistic-locking...