PT-2026-98116

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate sdma queue function fails to perform bounds-checking on the restore sdma id variable. This variable, which allows the...

PT-2026-98114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate doorbell function fails to perform bounds checking on the doorbell ID. This occurs when the doorbell ID is set to a specifi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: NFSv4.2: fixed issues related to nfs42sscopen. A destination server, when performing a COPY operation, should not accept the passed-in filehandle if it is not a regular filehandle. If the allocfilepseudo function fails, we nee...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: cxl: Fixed a memory leak in the error handling path. The bitmapzalloc function must be balanced with a corresponding bitmapfree function in the error handling path of afuallocateirqs...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The validation of the request buffer size was added in smb2allocaterspbuf. The response buffer should be allocated in smb2allocaterspbuf before validation of the request. However, fields within the payload as well as the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: mcast: added RCU protection to mldnewpack The mldnewpack function can be called without holding RTNL or RCU. It should be noted that we can no longer use sockallocsendskb, because ipv6.igmpsk relies on GFPKERNEL...

Astra Linux – Vulnerability in xorg-server

A use-after-free vulnerability was discovered in the ProcRenderAddGlyphs function of Xorg servers. This issue arises when the AllocateGlyph function is called to store new glyphs sent by the client to the X server. As a result, multiple entries may point to the same non-refcounted glyphs...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: PNP: Fixed a name memory leak in pnpallocdev. After committing change 1fa5ae857bb1 “Driver core: get rid of struct device’s busid string array”, the name of the device is allocated dynamically. devsetname was moved after pnpaddid...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Check that the null return value of ACPIALLOCATEZEROED in acpidbdisplayobjects is valid. The issue was reported by ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4. The ACPIALLOCATEZEROED function may fail, and...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: NFC: nci: fixed a memory leak in nciallocatedevice The nfcmrvldisconnect function fails to free the hcidev field in the struct ncidev. This issue was fixed by freeing hcidev in ncifreedevice. BUG: Memory leak Unreferenced obje...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added NULL pointer dereferencing checking at the end of attrallocateframe. It is preferable to exit through the out: label because internal debugging functions are located there...

Race Condition

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Race Condition via the checkout process in the consumable API endpoint. An attacker can over-allocate inventory and cause negative stock levels by submitting concurrent...

CVE-2026-68554 Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

SUSE CVE-2026-73215

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...

CVE-2026-73215

A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port...

CVE-2026-73215

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...

CVE-2026-73215

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...

CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

SUSE CVE-2026-64599

In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in mesoncryptoprobe When mesonallocatechanlist fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. mesoncryptoprobe then jump to...