Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: md/raid1: Fixed issues with writepending references and reference leaks during write failures. In raid1makerequest, a reference to writePending is acquired before mdwritestart is called, and then raid1writerequest is called...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: Ensure that traceeventfile has a ref counter. The following actions can cause the kernel to crash: cd /sys/kernel/tracing echo 'p:sched schedule' kprobeevents exec 5events/kprobes/sched/enable kprobeevents exec 5&- Th...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of isoconn The functions isoconndel and isochandel involve a race condition that can lead to a double deletion of isoconn. Task hdev-workqueue Task 2 isoconndel isochandel isoconnholdunlesszero...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dlm: fixed the addition of a message handling mechanism in sendqueue. In a benchmark scenario where many requests are triggered, which results in a large number of DLM messages being sent across the network, it is possible that...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192 – Check runtime resume during probe. The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware. However, it uses pmruntimegetsync without checking the return...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: holding the connection in the hciconnectbigsync callback. There is a theoretical use-after-free vulnerability if the connection is freed while the hcisync task is running. The issue is mitigated by keeping tra...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: vlan: fixed an underflow issue related to the realdev refcnt. An error is injected before devholdrealdev in registervlandev, and the following testcase is executed: bash ip link add dev dummy1 type dummy ip link add name...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - md/raid10: Fixed the issue of a “writesPending” reference being retained after write request failures. - In raid10makerequest, the “writesPending” reference is acquired with mdwritestart before dispatching write requests...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: liveupdate: Fixed issues in luofileunpreservefiles and luofilefinish. In luofileunpreservefiles and luofilefinish, the calls to moduleput and xaerase were reordered to ensure that the file handling module remains pinned while...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Resource release for the exe file was performed after a path resolution failure. The getcurrentexepath function takes a reference to the exefile and a path reference before resolving the path name. If the aapathname...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In the ISO section, there was a issue where references to the socket would leak after the socket is released. The function isosockkill checks whether !sockflagsk, SOCKZAPPED is true, and also checks whether...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement a reference counter for SRB The timeout handler and the done function are competing with each other. When qla2x00asynciocbtimeout starts to execute, it may be preempted by the normal response path via the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - In md/raid10, issues with writepending references and barrier reference leaks during discard failures were addressed. - In raid10makerequest, a reference to writepending is acquired before mdwritestart is called, and then...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nvmet: Fixed the reference count leak in nvmetsqcreate. In nvmetsqcreate, a reference to ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns an error directly without...

CVE-2026-74715

A flaw was found in the kernel. A reference imbalance vulnerability exists in the Berkeley Packet Filter BPF conntrack kfuncs. This occurs when the 'opts' argument, which can point to a shared map value, has its network namespace identifier netnsid read separately during reference acquisition and...

CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75931

fast-uri , a URI parser for the Node.js ecosystem, is vulnerable to host confusion and policy bypass (CVSS 3.1: 7.5 HIGH ). The root cause is that the host is canonicalized to ASCII form only when the input carries an explicit scheme; scheme-relative references (host preceded by //) are returned ...

CISA: Logging Reference Architecture

The Cybersecurity and Infrastructure Security Agency CISA developed the Logging Reference Architecture LRA in alignment with Office of Management and Budget Memorandum M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which w...

CVE-2026-76073: Authorization Bypass Through User-Controlled Key

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

PT-2026-80192

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.4 fast-uri versions 3.1.3 through 3.1.5 fast-uri versions 4.0.1 through 4.1.2 Description fast-uri, a URI parser for Node.js, fails to consistently canonicalize hosts to ASCII form when processing...