Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In net/sched: taprio, the variable TCATAPRIOATTRSCHEDCYCLETIME is limited to INTMAX. syzkaller detected no division errors in the function divs64rem, which is called from getcycletimeelapsed. In this function, schd-cycletime serv...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: Replace BTRFSMAXEXTENTSIZE with fsinfo-maxextentsize. In a zoned filesystem, data writing is limited by maxzoneAppendSize. A large ordered extent is split according to the size of a bio. On the other hand, the number of...

Astra Linux – Vulnerability in PHP 7.3

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16, and 8.2.X before 8.2.3, the core path resolution function allocates a buffer that is one byte too small. When resolving paths with lengths close to the system’s MAXPATHLEN setting, this may result in the byte after the allocated buffer being...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The IPv6 implementation in the Linux kernel before version 6.3 has a maxsize threshold in the net/ipv6/route.c file that can be easily exceeded. This can lead to a denial of service condition, where the network becomes unreachable, resulting in errors when IPv6 packets are sent through a raw sock...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: DSA: QCA8K: resetting the CPU port when the MTU changes. It was discovered that the documentation lacks a fundamental detail regarding how to correctly change the MAXFRAMESIZE of the switch. In fact, if the MAXFRAMESIZE...

CVE-2026-15965: Unrestricted Upload of File with Dangerous Type

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

CVE-2026-68315

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

CVE-2026-68254

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-18370

entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...

EUVD-2026-55586

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

EUVD-2026-55466

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68365

The CVE concerns the Linux kernel USB serial driver for io_edgeport. The vulnerability arises because edge_interrupt_callback() adds a 16-bit transmit-credits value to txCredits without enforcing maxTxCredits. edge_write() then uses (txCredits − software FIFO count) as the data that fits, and sin...

CVE-2026-68320

CVE-2026-68320 concerns the Linux kernel SCTP implementation. The issue arises in sctp_auth_ep_add_chunkid, which uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, while the destination in sctp_cookie/gathered state only holds SCTP_AUTH_MAX_CHUNKS (16) entries. When...

CVE-2026-68315 sctp: validate stream count in sctp_process_strreset_inreq()

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

CVE-2026-68315

Summary (CVE-2026-68315) : In the Linux kernel SCTP implementation, processing a RESET_IN_REQUEST from a peer can derive a stream count from the parameter length and then exceed SCTP_MAX_CHUNK_LEN when constructing the corresponding RESET_OUT_REQUEST. The OUT header is 16 bytes vs IN header 8 byt...

EUVD-2026-55416

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

EUVD-2026-55398

In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPCNLMEDIASET and TIPCNLBEARERSET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceedin...

CVE-2026-68297

The CVE-2026-68297 issue affects the Linux kernel TIPC module: user-supplied MTU values above U16_MAX (65535) are not bounded, causing truncation when stored in u16 fields and leading to division-by-zero in tipc_link_set_queue_limits, triggering a crash/DoS via local user namespaces. Two paths (T...

CVE-2026-68291 idpf: fix max_vport related crash on allocation error during init

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...