Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nvme-core: fixed the devpmqos memory leak Called devpmqoshidelatencytolerance in the error unwinding patch to avoid the kmemleak issue: blktests master kmemleak-clear; ./check nvme/044; blktests master kmemleak-scan ;...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Avoid buffer overflow attacks in the smusyssetpptable function. If a malicious user provides a smaller pptable through sysfs, followed by a larger one, it may lead to a buffer overflow attack in the smusyssetpptable...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: Use pmruntimeresumeandget in suspend. Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter in case of failure, eliminati...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: coresight: cti: Fixed a hang that occurred in ctidisablehw and ctienablehw. These functions are called from an atomic context, so they should not use runtime PM, as this can result in a sleep when communicating with the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power-up sequence According to the errata1: ERR050531: The power-down handshake for VPUNOC may hang during the power-up/down cycling of VC8000E/VPUMIX. Description: There may be a timing issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: The PHY layer is now treated as a shared domain for DSI/CSI. The MIPI DSI and CSI domains share control bits related to clock and reset. This can lead to incorrect behavior if one domain disables the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: hi846: The usage of pmruntimegetifinuse has been corrected. pmruntimegetifinuse not only returns non-zero values when the device is in use, but it can also return a negative errno. Especially during resume from system...

CVE-2026-74691 net: thunderbolt: Tear down DMA paths before stopping the rings

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring's descriptor base and tbnetfreebuffers...

Security Bulletin: This Power System update is being released to address CVE-2026-19234

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: This Power System update is being released to address CVE-2026-17494

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system...

Security Bulletin: This Power System update is being released to address CVE-2026-16933

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hoste...

Security Bulletin: This Power System update is being released to address CVE-2026-17063

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-17429

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted...

Security Bulletin: This Power System update is being released to address CVE-2026-16930

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-19321

Summary Power Systems Firmware is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful...

CVE-2026-74329

A flaw was found in the Linux kernel's watchdog subsystem. When a watchdog device is unregistered, its Power Management PM notifier may not be properly removed. This can lead to a stale pointer being used during a subsequent suspend/resume operation, potentially causing system instability or a...

EUVD-2026-62964

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

EUVD-2026-62962

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

EUVD-2026-62960

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...