95 matches found
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access In dasdprofilestart the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel...
CVE-2026-68303
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed before its dependent drivers vc4hvs/vc4v3d the vc4hvsunbind/vc4v3dunbind...
CVE-2026-68303
The CVE-2026-68303 entry describes a Linux kernel fix in drm/vc4: hvs/v3d where unbind functions used dev_get_drvdata(master). When vc4-drm is removed before dependent drivers, vc4_hvs_unbind/vc4_v3d_unbind could dereference a freed pointer. The remediation is to use the data pointer passed to th...
SUSE CVE-2026-64230
In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...
CVE-2026-53385
In the Linux kernel, the following vulnerability has been resolved: vcscreen: fix null-ptr-deref in vcsnotifier during concurrent vcswrite A KASAN null-ptr-deref was observed in vcsnotifier: BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities,...
CVE-2026-46081 crypto: acomp - fix wrong pointer stored by acomp_save_req()
In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong pointer stored by acompsavereq acompsavereq stores &req-chain in req-base.data. When acompreqchaindone is invoked on asynchronous completion, it receives &req-chain as the data argument but casts it...
CLSA-2026-1779455173 Fix CVE(s): CVE-2026-43618
SECURITY UPDATE: integer overflow in compressed-token decoder allows memory disclosure to a malicious sender - debian/patches/CVE-2026-43618.patch: cap rxtoken at MAXTOKENINDEX and add overflow checks in recvcompressedtokennum/run; add CHUNKSIZE bound check in simplerecvtoken; initialize data=NUL...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fixed the issue of invalid dereferencing of indirect CCW data pointers. The issue involved invalid dereferencing of the indirect CCW data pointer in the dasdeckddumpsense function. This caused a kernel panic in certain...
CVE-2026-31490
A flaw was found in the Linux kernel's drm/xe/pf component. This vulnerability occurs when an error is returned during a migration restore operation, specifically from the xesriovpfmigrationrestoreproduce function, and the associated data pointer is not correctly cleared. This can lead to a...
Shopify: mruby-engine: UAF in MRubyEngine#initialize enables local RCE
Summary Double-init of MRubyEngine frees engine + unmaps mspace, but leaves Ruby DATAPTR dangling. Kernel reuses freed VA via mmapMAPFIXED. Attacker forges memrubyengine struct + mrbstate in reclaimed region, points mrbstate-allocf at libc.system, arranges bytes of mrbstate to also spell a shell...
EUVD-2026-11141
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...
DEBIAN-CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...
CVE-2026-3805 use after free in SMB connection reuse
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...
CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...
CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...
CVE-2023-53747
CVE-2023-53747 affects the Linux kernel’s virtual terminal driver (vc_screen). The issue arises in vcs_write() where, after console_unlock(), the vc_data object may be freed by vc_port_destruct(), causing a Use-After-Free when vcs_size() is later invoked. The fix reloads the pointer to the vc_dat...
MLX has Wild Pointer Dereference in load_gguf()
Summary Segmentation fault in mlx::core::loadgguf when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. Environment: - OS: Ubuntu 20.04.6 LTS - Compiler: Clang 19.1.7 Vulnerability Location: mlx/io/gguf.cp...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990057)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990057 advisory. In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe function is only...