CVE-2026-73466: Insertion of Sensitive Information into Log File

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-75945

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued...

CVE-2026-75945 A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued...

CVE-2026-75945

Arista EOS 4.36.1F is affected by a race condition (CWE-459 Incomplete Cleanup) in the 802.1X authenticator mode with per-supplicant ACL enforcement. When the clear dot1x host all command is issued, the race condition may leave a supplicant in an authorized state, allowing it to continue transmit...

CVE-2026-75945 A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued...

CVE-2026-54178 backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...

CVE-2026-54178 backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: cxgb4: Avoid accessing registers when clearing filters. A hardware register that contains the server TID base can contain invalid values when the adapter is in a faulty state for example, due to an AER fatal error. Reading these...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rose: Fixed NULL pointer dereferencing in rosesendframe. The syzkaller reported an issue: KASAN: NULL pointer dereferencing in range 0x0000000000000380-0x0000000000000387 CPU: 0 PID: 4069 Comm: kworker/0:15 Not tainted...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed a potential use-after-free when using clear keys. Similar to the commit c5d2b6fa26b5 "Bluetooth: Fixed a use-after-free in hciremoveltk/hciremoveirk". We cannot access the variable k after the kfreercu call...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, and Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ACPI: PAD: fixed a crash in exitroundrobin The kernel occasionally crashes in cpumaskclearcpu, which is called within exitroundrobin. This occurs when executing clearbitnr, addr with nr set to 0xffffffff. In such cases, the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: The issue of clearing the user buffer was fixed by properly using clearuser. To clear a user buffer, we cannot simply use memset; we must use clearuser. When using a virtio-mem device that registers a vmcorecb and ha...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actskbmod: prevent kernel-infoleak The syzbot discovered that tcfskbmoddump was copying four bytes from the kernel stack to user space 1. The issue here is that ‘struct tcskbmod’ has a four-byte hole. We need to cle...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: nbd: Fixed an issue where the process got hung during disconnection of a device. In our tests, “qemu-nbd” triggered a hung process: INFO: Task “qemu-nbd”: 11445 is blocked for more than 368 seconds. Not tainted...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Atm: lec: fixed a null-ptr-deref in lecarpclearvccs. Syzkaller reported a null-ptr-deref in lecarpclearvccs. This issue can be easily reproduced using the Syzkaller reproducer. In the ATM LANE LAN Emulation module, the same atmvc...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250omap: Implementation of Errata i2310 According to Errata i23100, an erroneous timeout can be triggered if this erroneous interrupt is not cleared. This could lead to a surge in interrupts. Therefore, the Errata i2310...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. The async nature of hot-unplug allows for a race condition, where the net device backend is cleared before the virtio-net PCI frontend is unplugged. A malicious guest could exploit this time window to trigger an assertion and cause a denial of service...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU on which the QSPI interrupt handler runs typically CPU 0 is excessively busy, it can lead to rare cases where the IRQ thread does not run before the transfer timeout is reache...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures in case of failure. Wipe all sensitive data from the stack for all IOCTLs that convert a clear-key into a protected-or-secure-key...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: Make sure to wait for page writeback in memoryfailure. Our syzkaller triggers "BUGON!listempty&inode-iwblist" in clearinode: - Kernel bug at fs/inode.c:519! - Internal error: Oops – Bug: 0 1 SMP - Modules linke...