CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Drivers: Net: qlcnic: Fixed a potential memory leak in qlcnicsriovinit. If the vpalloc function fails in qlcnicsriovinit, all previously allocated vp resources must be freed...

AZL-107898 CVE-2026-97032 affecting package sriov-network-device-plugin 3.7.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107889 CVE-2026-78669 affecting package sriov-network-device-plugin 3.7.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107895 CVE-2026-78663 affecting package sriov-network-device-plugin 3.7.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107892 CVE-2026-78659 affecting package sriov-network-device-plugin 3.7.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107901 CVE-2026-78660 affecting package sriov-network-device-plugin 3.7.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid deadlock in sriovnumvfsstore caused by pcidevlock The sysfs sriovnumvfsstore path acquires the device lock before the config space access lock: sriovnumvfsstore devicelock A 1 acquires the device lock sriovconfigure...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: Perform a null check on iov before dereferencing iov. Currently, the pointer iov is dereferenced before the null check of iov, which can lead to a null pointer dereference error. This issue is fixed by movi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ixgbe: Added locking to prevent panics when setting sriovnumvfs to zero. It is possible to disable VFs while the PF driver is processing requests from the VF driver. This can result in a panic. BUG: Unable to handle kernel...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: qed/qedsriov: protection against NULL references from qediovgetVFInfo. We must ensure that the information returned by the helper function is valid before using it. This issue was detected by the Linux Verification Center...

Astra Linux – Vulnerability in Qemu

A issue was discovered in QEMU versions 7.1.0 through 8.2.1. The registervfs function in hw/pci/pciesriov.c mishandles the situation where a guest writes a number of NumVFs that is greater than the total number of TotalVFs, resulting in a buffer overflow in VF implementations...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due to NULL pointer exception: Kernel attempted to read user page 0 - exploit attempt?...

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdkfd: Fixed a kernel panic that occurred when the reset attempt failed and was triggered again. In SRIOV configuration, the reset may fail to restore the ASIC to normal, but the cpsch function has already been called...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/hpre – fixed a resource leak in the remove process. In hpreremove, when the disable operation of qm sriov fails, the following logic should continue to be executed to release the remaining resources that have be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107285)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107285 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pincount leak gmcv9,100gartdisable isn't called matched with correspoding...

Linux Distros Unpatched Vulnerability : CVE-2026-72425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix FDIR CTRL VSI resource leak in iceresetallvfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated...