CVE-2026-53125

CVE-2026-53125 affects the Linux kernel. When user-space writes “clear” to /sys/block/md*/md/array_state, md_attr_store() drops the mddev reference before sysfs_unbreak_active_protection(), which can cause the last kobject reference to be dropped while the mddev is still eligible for deletion. Th...

EUVD-2026-38993

In the Linux kernel, the following vulnerability has been resolved: md: fix arraystate=clear sysfs deadlock When "clear" is written to arraystate, mdattrstore breaks sysfs active protection so the array can delete itself from its own sysfs store method. However, mdattrstore currently drops the...

CVE-2026-53125 md: fix array_state=clear sysfs deadlock

In the Linux kernel, the following vulnerability has been resolved: md: fix arraystate=clear sysfs deadlock When "clear" is written to arraystate, mdattrstore breaks sysfs active protection so the array can delete itself from its own sysfs store method. However, mdattrstore currently drops the...

CVE-2026-53083 bpf: Fix RCU stall in bpf_fd_array_map_clear()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix RCU stall in bpffdarraymapclear Add a missing condresched in bpffdarraymapclear loop. For PROGARRAY maps with many entries this loop calls progarraymappokerun per entry which can be expensive, and without yielding this c...

CVE-2026-53083 bpf: Fix RCU stall in bpf_fd_array_map_clear()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix RCU stall in bpffdarraymapclear Add a missing condresched in bpffdarraymapclear loop. For PROGARRAY maps with many entries this loop calls progarraymappokerun per entry which can be expensive, and without yielding this c...

EUVD-2026-38951

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix RCU stall in bpffdarraymapclear Add a missing condresched in bpffdarraymapclear loop. For PROGARRAY maps with many entries this loop calls progarraymappokerun per entry which can be expensive, and without yielding this c...

CVE-2026-53083

CVE-2026-53083 affects the rootio-linux package in RootOS (Debian 11/12, Ubuntu 22.04/24.04). Multiple fixed versions are available; Root has patched the vulnerability. Remediate by updating to the patched rootio-linux versions for the respective OS releases.

CVE-2026-53047

CVE-2026-53047 concerns the Linux kernel EFI capsule-loader heap allocation due to incorrect sizeof in phys array reallocation, potentially enabling a heap overflow on 32-bit PAEs. Public records in OSV show multiple vendor-specific patches and mitigations (e.g., Root Linux packages for Ubuntu 22...

CVE-2026-53044

In the Linux kernel, the issue affects the soc/tegra: cbb fabric lookup tables due to incorrect ARRAY_SIZE usage. The root cause is an ARRAY_SIZE miscalculation that could lead to out-of-bounds access during target timeout lookup. This has been fixed in the referenced commits; the vulnerability i...

CVE-2026-53044 soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAYSIZE in fabric lookup tables Fix incorrect ARRAYSIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup...

CVE-2026-53044 soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAYSIZE in fabric lookup tables Fix incorrect ARRAYSIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup...

EUVD-2026-38912

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAYSIZE in fabric lookup tables Fix incorrect ARRAYSIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup...

CVE-2026-52947

The CVE-2026-52947 issue affects the Linux kernel qrtr subsystem, specifically in qrtr_port_remove(), where the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This creates a race window where a ...

CVE-2026-52947 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: clk: Samsung: exynos-clkout – Assign .num before accessing .hws. The commit f316cdff8d67 annotates the hws member of the struct clkhwonecelldata with countedby. This informs the bounds sanitizer UBSANBOUNDS about the number of...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: clk: rs9: Reserve 8 struct clkhw slots for 9FGV0841. The 9FGV0841 has 8 outputs and registers 8 struct clkhw structures. Ensure that there are 8 slots available for these newly registered clkhw pointers. Otherwise, out-of-bounds...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Platform/x86: hp-bioscfg: Fixed out-of-bounds array access issues in ACPI package parsing. The hppopulateelementsfrompackage functions in the hp-bioscfg driver contain vulnerabilities related to out-of-bounds array access. These...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, the NDR array reader in RDPEAR did not perform bounds checking on the number of on-wire elements, and could write beyond the heap buffer allocated from hints, resulting in a heap buffer overflow in...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed an issue where engid could be negative, causing the streamenc regs array to be indexed out of bounds. The variable engid is used directly as an index into the streamenc regs array, which has only 5 elements...

CVE-2026-52915

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6thbh: reject oversized option lists struct ip6topts stores at most IP6TOPTSOPTSNR option descriptors, but hbhmt6check does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup...