CLSA-2025-1757961506 kernel: Fix of 28 CVEs

posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - xfrm: state: fix out-of-bounds read during lookup CVE-2024-57982 - nfsd: fix race between laundromat and freestateid CVE-2024-50106 - nfsd: split scstatus out of sctype CVE-2024-50106 - nfsd: avoid race...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i2c: smbus – fixed the issue of NULL function pointers being dereferenced. Baruch reported an OOPS error when using the Designware controller as the target. Only targeting mode breaks the assumption that one transfer function ...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781344094)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781344094 advisory. - In the Linux kernel, the following vulnerability has been resolved: i2c: designware: use casting of u64 in clock multiplication to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: i2c: designware: use casting of u64 in clock multiplication to avoid overflow In functions i2cdwscllcnt and i2cdwsclhcnt, there may be an overflow issue due to the reliance on the values of the given parameters, including icclk...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fixed handling of real but unexpected device interrupts. The commit c7b79a752871 "mfd: intel-lpss: Added Intel Alder Lake PCH-S PCI IDs" caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S...

CVE-2026-80621

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

UBUNTU-CVE-2026-80621

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-80621 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

CVE-2026-74654: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-10683

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683

The Connected papers describe CVE-2026-10683 affecting the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) in target/slave mode. The rx_full interrupt gates write_requested() based on dw->state != CMD_SEND, and the state is reset to READY only on STOP. START_DET, which would reset state ...

CVE-2026-10683

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

EUVD-2026-49399

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683 DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683 DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683 DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683: Loop with Unreachable Exit Condition

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

PT-2026-65093

Name of the Vulnerable Software and Affected Versions Synopsys DesignWare I2C driver affected versions not specified Description When operating in target/slave mode, the rx full interrupt handler restricts the write requested callback based on the dw-state variable. Because the START DET interrup...

CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...