PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

Ubuntu 20.04 LTS : Linux kernel (KVM) vulnerabilities (USN-8667-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8667-1 advisory. Siebe Devroe, Hlose Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-8666-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8666-1 advisory. Siebe Devroe, Hlose Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated...

USN-8666-2: Linux kernel (Azure) vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

USN-8666-2 linux-azure-5.4, linux-azure-fips vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211: handling of 2x996 RU allocation in cfg80211calculatebitratehe Currently, NL80211RATEINFOHERUALLOC2x996 is not being handled in cfg80211calculatebitratehe, resulting in the following warning: kernel: Invalid HE MCS...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Cancel wiphywork before freeing wiphy A wiphywork can be queued from the moment it is allocated and initialized i.e., via wiphynewnm. When a wiphywork is queued, the rdev::wiphywork function is also queued. If the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fixed a use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be scheduled, and then completed before the line ndev-stats.txbytes += skb-len; 46.912801...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Avoid reading uninitialized memory in ath9khtcrxmsg. syzbot reports that the uninitialized value is accessed at ath9khtcrxmsg. For ioctlUSBRAWIOCTLEPWRITE, the function ath9khifusbrxstream may call with pktlen = 0, b...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath11k – decreasing the MHI channel buffer length to 8KB Currently, the buflen field of ath11kmhiconfigqca6390 is set to 0, causing MHI to use the default size of 64KB to allocate channel buffers. This may lead to failures ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: rt2x00 – The beacon queue is restarted when a hardware reset occurs. When a hardware reset is triggered, all registers are reset, causing all queues to be stopped in the hardware interface. However, mac80211 does not...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: Fixed an issue where information leaks occurred in the wilwritefilewmi function. The simplewritetobuffer function will succeed if even a single byte is initialized. However, we need to initialize the entir...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211 – Reject authentication/association requests to APs using our own address. If the AP uses our own address as its MLD Media Access Layer address or BSSID Basic Service Set Identifier, then something is clearly wrong...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: The PMK parameter is now passed as binary data, rather than hexadecimal data. It appears that the hexadecimal passphrase mechanism does not work on newer chips/firmwares e.g., BCM4387. There was actually...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm – fixed a potential out-of-bounds read in iwlmvmndmatchinfohandler The memcpy function assumes that the dynamic array notif-matches is at least as large as the number of bytes to be copied. Otherwise,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: wifi: brcmfmac: Fixed a potential stack-out-of-bounds issue in brcmfcpreinitdcmds. This patch fixes a read operation that leads to a stack-out-of-bounds situation when the buffer ‘buf’ that is not null-terminated is passed as ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start The ieee80211txbasessionhandlestart function may return NULL for sdata when a deauthentication process is ongoing. Here is a trace that illustrates the race condition involving...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: mt76: Do not run mt76ustatusworker if the device is not running. Fixed the issue of NULL pointer dereferencing, preventing the mt76ustatusworker thread from being executed if the device is not running yet. KASAN:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fixed a UAF in ieee80211scanrx The ieee80211scanrx function attempts to access scanreq-flags after a null check. However, a UAF Use-after-Allocation was observed when the scan is completed and ieee80211scancomplet...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A buffer overflow vulnerability was discovered in the Linux kernel’s Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. It can allow a local user to crash the system or escalate their privileges...