CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF 権限昇格 CVE-2023-20938 （Android binder ドライバの Use-After-Free）のローカル権限昇格 Proof-of-Concept です。 非特権シェルから uid 0 を取得し、SELinux を permissive に落とした上で、root シェルを起動します。 このビルドのターゲット：Android Cuttlefish / Goldfish AVD, x8664, カーネル 5.10.107 。 ⚠️ 認可された研究・教育目的のみ。...

CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

EUVD-2026-67559

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099000)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099000 advisory. In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098928)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098928 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098949)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098949 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/vc4: Do not check if plane-state-fb == state-fb Currently, when using non-blocking commits, the following kernel warnings can be observed: 110.908514 ------------ Cut here ------------ 110.908529 refcountt: Underflow; Use...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: ffs: The function ffsdataclear is called twice. This call occurs when ffsfskillsb and ffsep0release are executed. As a result, the function ffsdataclear is called twice when the userland process closes ep0 and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: mpt3sas: Fixed the use-after-free warning. Fixed the following use-after-free warnings that were observed during controller reset: refcountt: Underflow; use-after-free. WARNING: CPU: 23; PID: 5399; Location:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: resetting dst in the route object after setting up a flow. The dst field is now transferred to the flow object, and the route object no longer owns it. Resetting dst in the route object is necessary;...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Ice: Avoid bpfprog refcount underflow The Ice driver includes routines for managing XDP resources that are shared between the ndobpf operation and the VSI rebuild flow. The latter occurs, for example, when the user changes the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In tcpconnrequest, do not call reqskfastopenremove. The syzbot reported the following issue in tcpconnrequest: 0 If a listener is closed while a TFO socket is being processed in tcpconnrequest, inetcskreqskqueueadd does not set...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveauboref on a nouveaubo without initializing it and thus the backing ttmbo leads to a refcount underflow. Instead of calling nouveauboref in the unwind path of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfs: fixed UAF in direct writes In production, we have been encountering the following warnings consistently: ------------ cut here ------------ refcountt: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: Fixed an issue where the clientcount variable was incremented twice for public channels when dmachanget was called for a channel. This occurred first in balancerefcount, and again before returning. As a result, the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xsk: fixed the refcount underflow in the error path. This fix addresses a refcount underflow issue reported by syzbot, which can occur when the system runs out of memory. If xpalloctxdescs fails—and it can only fail due to...

AZL-97118 CVE-2026-74631 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...