Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitize numphys Information is stored in mrsasport-phymask. Values that are larger than the size of this field should not be allowed...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: scsi: megaraidsas: A resource leak has been fixed in case of probe failures. The driver does not properly clean up all allocated resources when the scsiaddhost or megasasstartaen functions fail during the PCI device probe. All...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportsas: Fixed error handling in sasPhyadd. If transportadddevice fails in sasPhyadd, the kernel may crash when trying to delete the device via transportRemoveDevice, which is called from sasRemoveHost. The kernel...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: megaraidsas: Fixed invalid node index On systems with DRAM interleave enabled, out-of-bound access was detected: megaraidsas 0000:3f:00.0: Requested/available msix 128/128 pollqueue 0 ------------ Cut here ------------...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: A use-after-free issue has been fixed for aborted TMF sastask instances. Currently, a use-after-free might occur if a TMF sastask is aborted before we handle the I/O completion in mpisspcompletion. This abort occurs...

PT-2026-86695

In the Linux kernel, the following vulnerability has been resolved: scsi: hisi sas: Add slave destroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

EUVD-2026-62589

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

PT-2026-78534

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/app id/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

UBUNTU-CVE-2026-74555

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix HA resume deadlock and hisisas disk-wake race Commit fbefe22811c3 "scsi: libsas: Don't always drain event workqueue for HA resume" introduced sasresumehanosync to avoid a deadlock: the PHYERESUMETIMEOUT handler,...

CVE-2026-74555

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix HA resume deadlock and hisisas disk-wake race Commit fbefe22811c3 "scsi: libsas: Don't always drain event workqueue for HA resume" introduced sasresumehanosync to avoid a deadlock: the PHYERESUMETIMEOUT handler,...

PT-2026-73007

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock and a race condition exist in the libsas component of the SCSI subsystem. A deadlock occurs when the PHYE RESUME TIMEOUT handler, executing on the HA event workqueue, calls sa...

SAS Login Panel - Detect

SAS login panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """SAS login panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAS Login Panel - Detect', 'description': 'SAS login...

kernel: Fix of 14 CVEs

nfnetlinkosf: validate individual option lengths in fingerprints CVE-2026-23397 - netfilter: nfnetlinkosf: avoid OOB read CVE-2026-23397 - bonding: limit BONDMODE8023AD to Ethernet devices CVE-2026-23099 - netlabel: fix out-of-bounds memory accesses CVE-2019-25160 - ext4: always check block group...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fixed the sashba.phy memory leak in mpi3mrremove Released mrioc-sashba.phy at .remove...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: A bad drive in the topology results in a kernel crash. When the SAS Transport Layer support is enabled and a device is exposed to the operating system through the driver, if INQUIRY commands fail, the driver release...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: pm8001: Fixed the runningreq for internal abort commands Disabling the remote PHY for a SATA disk causes a hang: bash root@none$ more /sys/class/sasPhy/phy-0:0:8/targetPortProtocols sata root@none$ echo 0...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021550 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sastransportportadd In mpt3sastransportportadd,...