EUVD-2026-55574

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled,...

CVE-2026-68167 btrfs: do not try compression for data reloc inodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...

EUVD-2026-55269

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validating the command header size against SVGACMDMAXDATASIZE This data originates from user space and is used in buffer offset calculations, which may potentially lead to an out-of-bounds access due to overflow...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: use skbheaderpointercareful skbheaderpointer does not fully validate negative @offset values. Use skbheaderpointercareful instead. GangMin Kim provided a report and a reproduction example for u32classify: Bug:...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in glib. Missing validation of the offset and count parameters in the gbufferedinputstreampeek function can lead to an integer overflow during length calculations. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - svcrdma: The use of rcpageoff for the byte offset in memcpy was corrected. - svcrdmacopyInlinerange: The page index rccurpage was added to the page base instead of the byte offset rcpageoff. Use rcpageoff to ensure that copi...

Astra Linux – Vulnerability in Python 3.11

The ‘zipfile’ module does not check the validity of the offset value specified in the ZIP64 End of Central Directory EOCD Locator record. Instead, the ZIP64 EOCD record is assumed to be the previous record in the ZIP archive. This behavior could be exploited to create ZIP archives that are...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iomap: The read range is adjusted correctly for positions that are not block-aligned. The iomapadjustreadrange function assumes that the position and length passed in are block-aligned. However, this is not always the case, as...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Squashfs: Check that the metadata block offset is within the acceptable range. Syzkaller reports a “general protection fault in squashfscopydata”. This issue is ultimately caused by a corrupted index look-up table, which resul...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed an issue to avoid overflow during left shift operations. The type of folio-index should be changed from pgofft to lofft to prevent overflow during left shift operations...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: An out-of-bounds access issue in parsesecdesc has been fixed. If osidoffset, gsidoffset, and dacloffset can be greater than smbntsdstruct.size. If they are smaller, it could lead to an out-of-bounds situation. Additionally...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: It is necessary to preserve the id of the register in the synclinked regs function. The synclinked regs function copies the id of knownreg to reg when propagating the bounds of knownreg to reg, using the offset of knownreg...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock-Galaxy 中文: READMEZH.md This is...

CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

CVE-2026-11743

The CVE concerns the SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The vulnerability arises in the read/write paths where a signed offset (off_t) is compared against an unsigned size using (offset + size) > data->size, allowing a negative offset to wrap to a ...

CVE-2026-19212

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: Fixed a issue where partial COW operations by pedit led to corruption of the page cache. tcfpeditact calculates the COW range for skbensurewritable once before the key loop, using tcfpoffmaxhint. However, this hint...