Astra Linux – Vulnerability in OpenSSL

The function X509VERIFYPARAMadd0policy is documented as implicitly enabling the certificate policy check during certificate verification. However, the implementation of this function does not actually enable the policy check, allowing certificates with invalid or incorrect policies to pass the...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory flaw after deallocation was discovered in the Linux kernel’s garbage collection for Unix domain socket file handlers. This flaw occurs when users call close and fget simultaneously, potentially triggering a race condition. This flaw allows a local user to crash the system or escalate the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In ipcheckmcrcu of igmp.c, there is a potential use after free due to improper locking. This could lead to a local escalation of privileges when opening and closing inet sockets, without the need for additional execution privileges. User interaction is not required for exploitation. Product:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The IPv6 implementation in the Linux kernel before version 6.3 has a maxsize threshold in the net/ipv6/route.c file that can be easily exceeded. This can lead to a denial of service condition, where the network becomes unreachable, resulting in errors when IPv6 packets are sent through a raw sock...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: afunix: Fixed a use-after-free in unixstreamreadactor. The syzbot reported the following crash 1. After releasing the unix socket lock, the u-oobskb can be changed by another thread. We must temporarily increase the skb refcou...

Astra Linux – Vulnerability in Firefox and Thunderbird

A use-after-free condition affected the creation of TLS sockets when memory pressure was present. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Timers for kernel sockets are properly terminated. We received various reports from syzbot that indicated that TCP timers would still fire even after the corresponding netns has been dismantled. Fortunately, Josef Bacik was...

Astra Linux - Vulnerability in webkit2gtk

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit prior to version 2.34.1 allows a limited sandbox bypass that enables a sandboxed process to trick host processes into believing that the sandboxed process is not confined by the sandbox, by abusing VFS system calls that manipulate its filesystem...

CVE-2026-15924: Use After Free

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

EUVD-2026-75537

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

CVE-2026-80925

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device invokes vlantransferfeatures, which dynamically changed...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

kernel: tcp: call sk_data_ready() after listener migration

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...

PT-2026-87803

Use after free in Windows AF UNIX Socket Provider allows an authorized attacker to elevate privileges locally...

The vulnerability of the rxgk_extract_token() function in the net/rxrpc/rxgk_app.c module, which is part of the RxRPC session support for the Linux operating system’s kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rxgkextracttoken function in the net/rxrpc/rxgkapp.c module, which supports RxRPC session sockets in Linux operating systems, is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the WAD (Web Access Daemon) in FortiOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of WAD Web Access Daemon in FortiOS operating systems is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created sockets...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...