ScreenOff

ScreenOff CVE-2026-52910 kernel crash poc. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation what socket + SOATTACHREUSEPORTCBPF + setsockopt race. timerfd/epoll callback storm slows down the receive path. replace the cBPF filter while the old prog is still in...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

CVE-2026-99139 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99139: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

PT-2026-117020

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO RESERVE MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SO RESERVE MEM" and commit d00c8ee31729 "net: fix possible NULL deref in sock reserve memory" only checked sk has...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisock: Fixed an issue where user input was not validated. The length of user input was checked before copying data...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: llcp: fixed unsafe copies in nfcllcpsetsockopt syzbot reported unsafe calls to copyfromsockptr 1 Use copysafefromsockptr instead. 1 BUG: KASAN: out-of-bounds access in copyfromsockptroffset include/linux/sockptr.h:49 inli...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ax25: rcu protect dev-ax25ptr syzbot identified a lockdep issue 1. We should remove the ax25 RTNL dependency in ax25setsockopt. This should also fix various potential UAF issues in ax25. 1 WARNING: A circular locking dependenc...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed a issue where user input was not validated using setsockopt. The length of user input was checked before data was copied...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDPUMEM|COMPLETIONFILLRING syzbot reported an illegal copy in xsksetsockopt 1 Make sure to validate the setsockopt @optlen parameter. 1 BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed an issue where user input was not validated. The length of user input was checked before data was copied...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock()

A flaw was found in the Linux kernel’s TLS implementation net/tls/tlsdevice.c. The function getnetdevforsock is invoked during setsockopt, which is not executed under RCU Read-Copy-Update protection. It previously used skdstgetsk-dev, which can lead to a use-after-free UAF if the sk’s destination...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: Validates user input to ensure it is of the expected length. I received multiple syzbot reports indicating that old bugs were exposed due to BPF after the commit 20f2505fb436 “bpf: Try to avoid kzalloc in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fixed a UAF in j1939skmatchfilter during setsockoptSOJ1939FILTER. Locked jsk-sk to prevent UAF when setsockopt..., SOJ1939FILTER, ... modifies jsk-filters while receiving packets. The following issue was observed on t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: SCO: Fixed issue where user input is not validated before calling setockopt. The syzbot reported that scosocksetsockopt copies data without checking the length of the user input. BUG: KASAN: Out-of-bounds access in...

CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

PT-2026-94441

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where l2cap chan::conn retains a reference and remains non-NULL even after the associated hci conn is deleted. Accessing fields such...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from accessing l2capchan::conn in Bluetooth L2CAP’s get/setsockopt function. No checks are performed to ensure that the hciconn is still alive and that there is no lock held on it. This could lead to KASAN crashes and data...