Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloudcontrol.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 root@kitploit: nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data...

cve-2026-42945

CVE-2026-42945 — Desbordamiento de montón en la reescritura de NGINX: Análisis, DoS y puerto RCE acreditado Investigación de seguridad sobre CVE-2026-42945 CVSS 4.0 9.2 CRÍTICO: un desbordamiento de búfer en el montón en el motor de scripts de NGINX donde una rewrite con argumentos en la...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

CVE-2026-80662

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098784)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098784 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code ...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when link nums greater than maxlinks Reason The Coverity report indicates an OVERRUN warning. There are only maxlinks elements within dc-links. The number of links can reach...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ima: fixed the buffer overflow issue in imaeventdigestinitcommon. The function imaeventdigestinit calls imaeventdigestinitcommon, using HASHALGOLAST. This value is then used to access the array hashdigestsize, resulting in a buff...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: lzo – Fix for compression buffer overflows Unlike the decompression code, the compression code in LZO never checked for output overflows. Instead, it assumes that the caller always provides sufficient buffer space, withou...

Astra Linux – Vulnerability in Linux 5.10, Linux

The fix for XSA-423 added logic to the Linux’ netback driver to handle cases where a packet is split by a frontend, resulting in not all of the headers being together in one piece. Unfortunately, the introduced logic did not account for the extreme case where the entire packet is split into as ma...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp – Fixed the overflow checking of the wmfw header. The issue involved fixing the check to ensure that the firmware file buffer is large enough to accommodate the wmfw header, thereby preventing the buffer from bein...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp: Prevent buffer overflows when processing V2 algorithm headers. It is necessary to ensure that all fields of a V2 algorithm header fit within the available firmware data buffer. The wmfw V2 format introduced...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: qed: Do not collect too many protection override GRC elements In the protection override dump path, the firmware may return far too many GRC elements, leading to attempts to write beyond the previously allocated dump buffer. This...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xHCI: Properly handling isoc Babble and Buffer Overrun events. xHCI 4.9 explicitly prohibits making assumptions that the xHC has released its ownership of a multi-TRB TD when an error occurs in one of the early TRBs. However,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: hda/ca0132: fixed a buffer overflow issue in tuningctlset The tuningctlset function might cause a buffer overflow if it does not break from the loop by matching A. static int tuningctlset... for i = 0; i TUNINGCTLSCOUNT;...

SUSE CVE-2026-74616

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skbsharedinfo tailroom xdpfclone clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe later treats that page like a normal XDP frame and expects the usual...

CVE-2026-74616

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skbsharedinfo tailroom xdpfclone clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe later treats that page like a normal XDP frame and expects the usual...

EUVD-2026-64553

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skbsharedinfo tailroom xdpfclone clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe later treats that page like a normal XDP frame and expects the usual...