PT-2026-95637

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description An unbounded memory allocation issue exists in the handle staging req function within prefill/decode disaggregation deployments. The system fails to validate the chunk idx variable received from ZMQ...

PT-2026-95411

Name of the Vulnerable Software and Affected Versions Sublime Text 4 versions prior to Build 4193 Sublime Text 3 versions prior to Build 3208 Description A local privilege escalation issue exists in the update staging mechanism. An unprivileged local attacker can place a malicious DLL in the...

SUSE CVE-2026-90016

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

PT-2026-95024

Name of the Vulnerable Software and Affected Versions Verizon Cloud for Android versions prior to 26.7.10 Description A path traversal issue exists where co-resident malicious applications can write attacker-controlled bytes outside the intended staging directory. This occurs due to unsanitized...

PT-2026-94939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ipu7 resume function within the staging media ipu7 component. The issue arises because pm runtime get sync is called before resuming the device; if t...

DEBIAN-CVE-2026-90016

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

PT-2026-93658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the rtw action frame parse function within the rtl8723bs staging driver. The function accepts a frame len parameter but fails to validate it before indexi...

CVE-2026-90016: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

PT-2026-93657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the rtw restruct wmm ie function within the rtl8723bs staging driver. The issue occurs when the function scans the in ie buffer for a WMM IE; if the match...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8712 – fixed bugs related to use after freeing memory. The Read/WriteMACREG callbacks are set to NULL, so the read/writemacreghdl functions do nothing other than freeing the “pcmd” pointer. This results in a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A issue was discovered in the Linux kernel before version 6.3.2. A use-after-free was found in the rkvdecremove function in drivers/staging/media/rkvdec/rkvdec.c...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8712: fixed a use-after-free in rtl8712dlfw Syzbot reported a use-after-free in rtl8712dlfw. The issue occurred due to a race condition between r871xudevremove and dondoopen callbacks. It’s clear from the crash log...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8723bs – fixed a potential out-of-bounds read in rtwrestructwmmie. The current code checks whether ‘i + 5 inlen’ at the end of the if statement. However, it accesses ‘iniei + 5’ before this check, which could lead to ...

Astra Linux – Vulnerability in Linux

In the Linux kernel, from drivers/staging/rtl8188eu/osdep/ioctllinux.c, the function rtwwxsetscan allows writing beyond the end of the -ssid array. NOTE: From the perspective of kernel.org’s release processes, CVE IDs are not typically used for drivers/staging/ unfinished work. However, system...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fixed the stack information leak. The name of the tty driver is also used after registering the driver, and it must specifically not be allocated on the stack to prevent information from leaking into the user spac...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: r8712: Fixed a memory leak in r8712initxmitpriv In the aforementioned routine, memory is allocated in several places. If the first attempt to allocate memory succeeds, but a subsequent attempt fails, the routine will cau...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8723bs – fixed a potential memory leak in rtwinitdrvsw. In rtwinitdrvsw, various initialization functions are called to populate the padapter structure, and certain checks are performed on their return values. However...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Staging: gdm724x: fixed the use of a variable after it is freed in gdmlterx. The netifrxni function frees the skb, so we cannot dereference it to save the skb-len...

CVE-2026-89522

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...

EUVD-2026-76428

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...