GHSA-GF93-XCCM-5G6J MARIN3R: Cross-Namespace Vulnerability in the Operator

Summary Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate allows users to bypass RBAC and access Secrets in unauthorized namespaces. Affected Versions All versions prior to v0.13.4 Patched Versions v0.13.4 and later Impact Users with permission to create...

CLSA-2025-1762244848 kernel: Fix of 5 CVEs

ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 - ext4: fix memory leak in ext4fillsuper - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - ALSA: usb-audio: Fix an...

PT-2025-45721

Summary Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate allows users to bypass RBAC and access Secrets in unauthorized namespaces. Affected Versions All versions prior to v0.13.4 Patched Versions v0.13.4 and later Impact Users with permission to create...

MARIN3R: Cross-Namespace Vulnerability in the Operator

Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate allows users to bypass RBAC and access Secrets in unauthorized namespaces...

PT-2025-45114

Name of the Vulnerable Software and Affected Versions MARIN3R versions 0.13.3 and below Description MARIN3R, a lightweight, CRD based envoy control plane for kubernetes, contains a flaw where a cross-namespace secret access issue exists in the DiscoveryServiceCertificate component. This allows...

CLSA-2025-1762180294 podman: Fix of CVE-2024-9676

CVE-2024-9676: fix symlink traversal vulnerability in containers/storage library to prevent hanging and denial of service when running malicious images via automatically assigned user namespace...

PT-2025-52913

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where the ns list node for initial namespaces is not always initialized. This can lead to problems with namespace management. Recommendations At the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: A race condition in the call to haslockedchildren was fixed. maydecodefh calls haslockedchildren while holding no locks. This is an oopsable race condition… The other callers are safe, as they hold namespacesem, and...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfsfsprocnetinit fails. The syzbot reported a warning below 1 after a fault injection in nfsfsprocnetinit. 0 When nfsfsprocnetinit fails, /proc/net/rpc/nfs is not removed. Later, rpcprocexit...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: Interface: Fixed an issue where a use-after-free occurred after changing the collectmd xfrm interface. The collectmd property of xfrm interfaces can only be set during device creation. Therefore, the xfrmichangelink functio...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.1)

The version of AHV installed on the remote host is prior to 10.3.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1.1 advisory. - A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata...

SUSE CVE-2025-40072

In the Linux kernel, the following vulnerability has been resolved: fanotify: Validate the return value of mntnsfromdentry before dereferencing The function dofanotifymark does not validate if mntnsfromdentry returns NULL before dereferencing mntns-userns. This causes a NULL pointer dereference i...

Siemens SIMATIC Devices Improper Initialization (CVE-2024-35910)

In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test...

CVE-2025-12103

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

CVE-2025-12103 Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

CVE-2025-12103

CVE-2025-12103 affects Red Hat OpenShift AI Service (TrustyAI). The component creates a role trustyai-service-operator-lmeval-user-role and a ClusterRoleBinding trustyai-service-operator-default-lmeval-user-rolebinding applied to system:authenticated, granting every authenticated user/service acc...

CVE-2025-40072

In the Linux kernel, the following vulnerability has been resolved: fanotify: Validate the return value of mntnsfromdentry before dereferencing The function dofanotifymark does not validate if mntnsfromdentry returns NULL before dereferencing mntns-userns. This causes a NULL pointer dereference i...

CVE-2025-40072 fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing

In the Linux kernel, the following vulnerability has been resolved: fanotify: Validate the return value of mntnsfromdentry before dereferencing The function dofanotifymark does not validate if mntnsfromdentry returns NULL before dereferencing mntns-userns. This causes a NULL pointer dereference i...

CVE-2025-40072

CVE-2025-40072 concerns the Linux kernel and describes a NULL pointer dereference in do_fanotify_mark() caused by not validating the return value of mnt_ns_from_dentry() before dereferencing mntns->user_ns. The publicly provided data shows the issue and a patch that fixes it by checking the re...

Malicious Package

Overview deere-ui-namespace is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...