kata-cve-2020-2023-poc

kata-cve-2020-2023-poc 1. Reproduce Environment Note: The environment needs support KVM https://github.com/ssst0n3/dockerarchive/tree/branchubuntu-20.04docker-ce-19.03.11containerd.io-1.4.9kata-1.11.0 $ git clone https://github.com/ssst0n3/dockerarchive.git $ cd dockerarchive $ git checkout...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both “count” and “scan” debugfs files unconditionally. This assumes that every shrinker implements both countobjects and scanobjects, which is not...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The “trigger” debugfs file contains a hand-written -write handler triggerwrite that dereferences the per-device gpiolapollpriv. The file is created usi...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created via debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. Currently, vfiodevicedel calls vfiodevicedel prio...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2cdeladapter frees the adapter’s debugfs directory before it unregisters the adapter device; however, the newdevice sysfs attribute remains writable until devicedel is called. Writin...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links, it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reconodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break, then “pstate” is not a valid pstate pointer. Introduce a “found” variable instead. The check is reachable...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it using the signed "%d" format into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, is...

SUSE CVE-2025-38596

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthorgemcreatewithhandle debugfs code The object is potentially already gone after the drmgemobjectput. In general the object should be fully constructed before calling drmgemhandlecreate, except the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr function sends the Zephyr vendor command 0xfc08 Read Build Information and passes the response to btdevinfo and hcisetfwinfo as a “%s” string starting...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i40e: remove read access to debugfs files The ‘command’ and ‘netdevops’ debugfs files are legacy debugging interfaces supported by the i40e driver since its inception, as documented in commit 02e9c290814c “i40e: debugfs interface...

CVE-2026-99150

A flaw was found in the Linux kernel's AMD GPU driver. When an error occurs while copying register data to user space during a debugfs read operation, the driver improperly releases a runtime Power Management PM reference twice. A local user could exploit this flaw by providing an invalid memory...

CVE-2026-99022

A flaw was found in the Linux kernel's LTC3676 regulator driver. The driver improperly marks write-only command registers, including the hardware reset register, as readable. A local user with administrative privileges can cause a Denial of Service DoS by reading the regulator registers through...

CVE-2026-99204

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...