CVE-2026-52946

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in sendsigio and sendsigurg when a process group receives a signal. When FASYNC is configured for a proces...

CVE-2026-52946

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in sendsigio and sendsigurg when a process group receives a signal. When FASYNC is configured for a proces...

CVE-2026-52953

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 1 SMP NOPTI Call Trace: dorawspinlock+0xaa/0x...

CVE-2026-53048 gfs2: prevent NULL pointer dereference during unmount

In the Linux kernel, the following vulnerability has been resolved: gfs2: prevent NULL pointer dereference during unmount When flushing out outstanding glock work during an unmount, gfs2logflush can be called when sdp-sdjdesc has already been deallocated and sdp-sdjdesc is NULL. Commit 35264909e9...

CVE-2026-52953

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 1 SMP NOPTI Call Trace: dorawspinlock+0xaa/0x...

CVE-2026-52946 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in sendsigio and sendsigurg when a process group receives a signal. When FASYNC is configured for a proces...

CVE-2026-52946

Summary of CVE-2026-52946 (Linux kernel) Root cause: A SOFTIRQ-unsafe lock order deadlock occurs in fasync signaling for process groups when signals are delivered. Specifically, send_sigio() and send_sigurg() traverse the task list under read_lock(&tasklist_lock) from softirq context, which can d...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the connect process. An attacker can initiate unauthorized connections to arbitrary URLs using credentials IDs of their choosing by tricking a user into performing unwanted actions while authenticated...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to a missing permission check in the connect process. An attacker can initiate unauthorized connections to arbitrary URLs by supplying crafted credentials, potentially exposing sensitive information or...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPHMAXKEYLEN When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone and generally has a reasonable length. The new CEPHMAXKEYLEN check replaces the existi...

Astra Linux – vulnerability in Chromium

Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Add call to putpid Add a call to putpid corresponding to gettaskpid. host1xmemorycontextalloc does not take ownership of the PID so we need to free it here to avoid leaking. [email protected]: reword commit message...

Astra Linux – vulnerability in capstone

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and earlier, Skipdata length is not bounded; therefore, a user-supplied skipdata callback may cause csdisasm/csdisasmiter memcpy to write more than 24 bytes into csinsn.bytes, resulting in a heap buffer overflow during the disassembly...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash in processv2sparseread for encrypted directories A crash has been reported in processv2sparseread when handling fscrypt-encrypted directories. This issue occurs under the Ceph msgr2 protocol in secure mode. It can...

Astra Linux – vulnerability in freeipa

A flaw was identified in the FreeIPA API audit; it sends the entire FreeIPA command line to journalctl. As a result, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials—including the administrator password—into the journal database. In the worst-cas...

Astra Linux – vulnerability in webkit2gtk

The issue has been resolved through improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. Processing maliciously crafted web content may result in an unexpected process...

Astra Linux – vulnerability in webkit2gtk

This issue has been resolved through improved state management. It is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3. Processing maliciously crafted web content may result in an unexpected process crash...

Astra Linux – vulnerability in webkit2gtk

The issue has been resolved through improved memory handling. This problem is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3. Processing maliciously crafted web content may result in an unexpected process crash...

Astra Linux – vulnerability in webkit2gtk

The use-after-free issue has been resolved through improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. Processing maliciously crafted web content may result in an unexpected...

Astra Linux – vulnerability in Chromium

In Skia, reading out of bounds in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to retrieve potentially sensitive information from process memory via a specially crafted file. Chromium security severity: Medium...