EUVD-2026-55312

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

CVE-2026-68211 media: stm32-dcmipp: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

CVE-2026-68211

The CVE concerns the Linux kernel component media: stm32-dcmipp. The issue arises when start_streaming() fails after vb2 has handed buffers to the driver via buf_queue(); if those buffers aren’t returned with vb2_buffer_done(), vb2_start_streaming() may WARN_ON(owned_by_drv_count) and the buffers...

CVE-2026-68209

The CVE-2026-68209 issue affects the Linux kernel sun4i-csi driver where, if start_streaming() fails, the vb2 framework does not return queued buffers, leading to buffer leaks and potential resource exhaustion. The root cause is that buffers queued via vb2_buffer_done() may not be returned before...

CVE-2026-68209 media: sun4i-csi: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

EUVD-2026-55310

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

EUVD-2026-55305

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68192

CVE-2026-68192 — normal mode Affect: Linux kernel with the brcmfmac WLAN driver. The function brcmf_pcie_release_scratchbuffers frees DMA buffers (shared.scratch and shared.ringupd) via dma_free_coherent() but does not clear the pointers, unlike release_ringbuffers(), which NULLs related pointers...

CVE-2026-68129

CVE-2026-68129 concerns the Linux kernel gve driver. Under extreme memory pressure, Rx buffer allocations can fail during the receive (Rx) buffer refill loop, causing the number of buffers posted to hardware to drop below a critical threshold and leading to a permanent queue stall. Consequences d...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: wan/fslucchdlc: Fixed the dmafreecoherent function in uhdlcmemclean. The priv-rxbuffer and priv-txbuffer are allocated together as contiguous buffers in uhdlcinit, but they are freed as two separate buffers in uhdlcmemclean...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: An alert is added in trytofreebuffers for folios that have no buffers attached. trytofreebuffers can be called on folios with no buffers attached when filemapreleasefolio is invoked on a folio that belongs to a mapping...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: cifs: A memory and information leak has been fixed in smb3reconfigure. In smb3reconfigure, if the smb3syncSession ctxpasswords function fails, the function returns immediately without freeing and erasing the newly allocated...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: The WARNON message in tracingbuffersmmapclose has been fixed for split VMA cases. When a VMA is split e.g., through partial munmap or MAPFIXED, the kernel calls vmops-close on each portion of the VMA. For trace buffer...

CVE-2026-11742

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...

CVE-2026-56818 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...

CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

EUVD-2026-53375

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

CVE-2026-71255

NanoMODBUS up to v1.23.0 contains a client-side out-of-bounds write in nanomodbus.c: recv_read_device_identification_res() uses server-provided object_length (0–246) to copy data, but only validates against remaining PDU, not against caller buffers_length. After strncpy(buffers_out[buf_index], st...

CVE-2026-67198 Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...