CVE-2026-68225 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

EUVD-2026-55266

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: ChipIdea UDC: Fix for DMA and SG cleanup in epnuke The ChipIdea UDC driver may encounter errors where “not-page-aligned sg buffers” occur when a USB device is reconnected after being disconnected during an active transfer...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert “i2c: i801: replace acpilock with I2C bus lock” This revertment is associated with the commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads may collect information abo...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fixed a race condition between concurrent call paths that invoke dwc3removerequests. This patch addresses a race condition caused by unsynchronized execution of multiple call paths that invoke dwc3removerequests, leadi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 one with start/stop bug, one without were seen to cause IOMMU faults after some Missed Service Errors. Faulting address ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Release the admin tagset if init fails. nvmefabrics creates a NVMe/FC controller in the following path: nvmfdevwrite → nvmfcreatectrl → nvmefccreatectrl → nvmefcinitctrl nvmefcinitctrl allocates the admin blk-mq resource...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nvme: Fix for admin queue leaks upon controller reset When the nvmeallocadmintagset function is called during a controller reset, an existing admin queue may still exist. Properly release this queue before allocating a new one to...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses. On 32-bit machines with CONFIGARMLPAE, it is possible for lowmem allocations to be backed by addresses located physically beyond the 32-bit address limit. This issue was...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: i2c: riic: Moving suspend handling to NOIRQ phase Commit 53326135d0e0 “i2c: riic: Adding suspend/resume support” added suspend support for the Renesas I2C driver. Following this change, on RZ/G3E, the following warning appears...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: omap-dma: fixed the resource leak in error paths caused by dmapool. The dmapool created by dmapoolcreate is not destroyed when dmaasyncdeviceregister or ofdmacontrollerregister fails, resulting in a resource leak in...

PT-2026-69954

Name of the Vulnerable Software and Affected Versions odh-model-controller affected versions not specified Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret function. The function improperly reads the Secret namespace from...

PT-2026-69952

Name of the Vulnerable Software and Affected Versions trustyai-service-operator affected versions not specified Description A flaw in the LMEvalJob controller allows an authenticated user within the cluster to bypass security policies by configuring a sidecar container. This bypass enables the...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, gomplate, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips, syft-fips, flux-source-controller,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, gomplate, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips, syft-fips, flux-source-controller,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, gomplate, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips, syft-fips, flux-source-controller,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, gomplate, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips, syft-fips, flux-source-controller,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: grafana-alloy, rancher-fleet, pulumi-language-yaml, src-fingerprint, gitsign, trivy, tfsec, flux-notification-controller, kots, flux, bom, steampipe, pulumi-language-dotnet, boring-registry, argo-cd, pulumi-kubernetes-operator, snyk-cli, grype,...