Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: A potential hang occurred in nilfsdetachlogwriter. Syzbot reported a potential hang during nilfsdetachlogwriter called when nilfs2 unmounts the file system. Analysis revealed that this issue arises because nilfssegctorsyn...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: Use memallocnofssave in pagecacheraorder. See commit f2c817bed58d “mm: Use memallocnofssave in readahead”, ensure that pagecacheraorder does not attempt to reclaim file-backed pages too often, as this can lead to a deadlock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: mediatek – Performing a runtime PM get operation on controllers during probing. The mt8183-mfgcfg component has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Do not create EA inodes under the buffer lock The ext4xattrsetentry function creates new EA inodes while holding the buffer lock on the external xattr block. This is problematic because all allocation-related locking...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Audit: Improved robustness of audit queue handling If the audit daemon becomes stuck in a stopped state, the kauditdthread function in the kernel might get blocked while attempting to send audit records to the audit daemon in the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: vfs: Do not evict inode under the inode lru traversing context The inode reclaiming process see function pruneicachesb collects all reclaimable inodes and marks them with the IFREEING flag. At that time, other processes will b...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: rcu: Dump vmalloc memory info safely Currently, for double invoke callrcu, the memory information of rcuhead objects will be dumped. If these objects are not allocated from the slab allocator, vmallocdumpobj will be invoked, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed a circular locking dependency in ocfs2initacl. A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: A circular locking dependency was detected. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: super: Fixed an emergency thaw deadlock on frozen block devices The dothawallcallback function calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen using bdevfreeze, releasing the last block-laye...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Drivers: USB: Host: Fixed a deadlock in oxubussuspend There is a deadlock in oxubussuspend, as shown below: Thread 1 | Thread 2 | timeraction oxubussuspend | modtimer spinlockirq //1 | Wait for a while ... | oxuwatchdog...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, the ffsep0read function holds ffs-mutex when it prepares to go to sleep and wait for an event. When no setup events are pending, it calls...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: The code for radeonfenceprocess has been removed in issignaled, preventing deadlocks. The attempt to advance the queue when checking whether the fence is signaled has been eliminated. This prevents deadlocks. The...

kernel: Linux kernel: Denial of Service in erofs filesystem

A flaw was found in the Linux kernel's erofs filesystem. A remote attacker can exploit this vulnerability without requiring any privileges. This issue occurs when insufficient memory during a memory mapping operation vmmapram in the bio completion path leads to a deadlock, causing a Denial of...

CVE-2026-105113

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105112

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

EUVD-2026-92017

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105113

The Nezha Dashboard (versions 1.8.0 before 2.3.13) is vulnerable to an improper locking issue (CWE-667). The root cause is a non-deferred mutex unlock that leaks during a nil-map panic path . An authenticated non-admin member can trigger this by making four specific notification API calls, result...

CVE-2026-105113 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105113 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105113 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...