CVE-2025-71094

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device can return an invalid address = PHYMAXADDR, which causes a warning in...

CVE-2025-71094 net: usb: asix: validate PHY address before use

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device can return an invalid address = PHYMAXADDR, which causes a warning in...

CVE-2025-71082 Bluetooth: btusb: revert use of devm_kzalloc in btusb

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devmkzalloc in btusb This reverts commit 98921dbd00c4e "Bluetooth: Use devmkzalloc in btusb.c file". In btusbprobe, we use devmkzalloc to allocate the btusb data. This ties the lifetime of all the...

CVE-2025-68819 media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100i2cmsg rlen value is a user-controlled value, but dtv5100i2cmsg does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeofst-data, an...

CVE-2025-68819

The CVE-2025-68819 issue affects the Linux kernel’s media: dvb-usb dtv5100 code path, where dtv5100_i2c_msg() uses a user-controlled rlen without validating it against st->data size, enabling an out-of-bounds read/write. Connected sources confirm a fix was applied to perform proper range check...

CVE-2025-68783 ALSA: usb-mixer: us16x08: validate meter packet indices

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

CVE-2025-68783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

CVE-2025-68783

CVE-2025-68783 affects the Linux kernel ALSA usb-mixer for the us16x08, where get_meter_levels_from_urb() previously derived a channel index from a meter packet without validating range, risking writes past the end of per-channel arrays when the packet contained a negative or out-of-range channel...

CVE-2025-68783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. An assertion failure occurred in the usbepget function in hw/net/core.c when attempting to retrieve the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fixed buffer overflow in the USB transport layer. There is a buffer overflow vulnerability in the USB 9pfs transport layer. In this case, inconsistencies in size validation between packet header parsing and actual data...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: It was resolved that holding the PM usage reference is necessary to avoid deadlocks between PM and MDIO operations along with RTNL. Prevent USB runtime PM autosuspend for AX88772 in bind. usbnet enables runtime PM...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - In the net subsystem, for USB devices, the disruptive netifwakequeue function in rtl8150setmulticast has been removed. - The syzbot tool reported a WARNING in the rtl8150startxmit/usbsubmiturb function. The sequence of event...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue The driver explicitly uses a 64-bit constant when the number of bits used for shifting is 32 as is the case with PC CAN FD interfaces supported by this driver. mkl: update subject, appl...

CVE-2025-68781: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otgevent is initialized in fslotgconf and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2...

PT-2026-2391

Name of the Vulnerable Software and Affected Versions PTPublisher version 2.3.4 Description The software contains an unquoted service path vulnerability in the PTProtect service. This allows local attackers to potentially execute arbitrary code with elevated privileges. The vulnerable path is...

CVE-2022-50935: Unquoted Search Path or Element

Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Program Files x86\Internet Telcel\ApplicationController.exe' to execute arbitrary code with elevated system privileges...

ROS-20260113-7316

Vulnerability of astudcgetstatus function in drivers/usb/gadget/udc/aspeedudc.c module of usb gadget driver of Linux kernel is related to incorrect index calculation. Exploitation of the vulnerability may allow an intruder to affect confidentiality, integrity and availability of protected...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unvalidated meter packet index in the usb-mixer: us16x08 driver, which could lead to out-of-bounds writes...

CVE-2025-68783: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...