Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53349)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: destroy stale expectfn expectations on unregister NAT helpers such as nfnath323 store a raw pointer to module text in exp-expectfn e.g. ipnatq931expect. nfcthelperexpectfnunregister only unlinks the callba...

UBUNTU-CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

UBUNTU-CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

DEBIAN-CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98763

A vulnerability exists in the Linux kernel USB core regarding how non-zero control endpoints are handled. In usb_enable_endpoint() , non-zero control endpoints populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same pointer. However, usb_disable_endpoint() fails to clear both s...

CVE-2026-98763 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98487: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

PT-2026-116706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the bridge multicast database MDB implementation. The function br mdb flush pgs maintains a pointer-to-pointer cursor while traversing mp-ports. Whe...

CVE-2026-46675

A flaw was found in libpng. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS by supplying a specially crafted PNG image. Incomplete decompression of certain metadata chunks can leave a dangling pointer in the library's internal decompression state. When an...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Net: Fixed a UAF Use-after-Allocation issue in packetrelease due to a race condition involving NETDEVUP. packetrelease has a race condition where NETDEVUP can re-register a socket into the arr array of fanout groups. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: as3722getregulatordtdata: fixed the issue where ofnodeput was called prematurely, resulting in a dangling ofnode pointer. In as3722getregulatordtdata, the ofgetchildbyname function acquires a reference to np, which is then assign...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: xilinx: formatterpcm: fixed the streamdata leak upon open failure In xlnxformatterpcmopen, streamdata is allocated, and adata-playstream or adata-capturestream is assigned early. If a subsequent function, such as...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fixed an issue where the listener socket was not properly freed after use, in the isoconnready function. The isoconnready function retrieves the BIS listener socket using isogetsock, which takes a reference to the...

Astra Linux – vulnerability in nbd

In nbd-server in nbd prior to version 3.24, there is an integer overflow that leads to a heap-based buffer overflow. A value of 0xffffffff in the name length field causes a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue affects the NBDOPTINF...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: afpacket: avoid erroring out after sockinitdata in packetcreate After sockinitdata, the allocated sk object is attached to the provided sock object. On error, packetcreate frees the sk object, leaving the dangling pointer in the...

Astra Linux – Vulnerability in Linux, Linux 5.10

The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling ‘file’ pointer...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: The initialization of the dangling pointer that occurs in vsk-trans has been addressed. During loopback communication, a dangling pointer can be created in vsk-trans, potentially leading to a Use-After-Free conditio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: hvsock: Initializing vsk-trans to NULL to prevent a dangling pointer. When hvs is released, there is a possibility that vsk-trans might not be initialized to NULL, which could lead to a dangling pointer. This issue is resolved by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: afcan – Do not leave a dangling sk pointer in cancreate. When the cancreate function fails, it releases the allocated sk object. However, sockinitdata has already attached this object to the provided sock object. This will...