blanket

blanket Blanket is a sandbox escape targeting iOS 11.2.6, although the main vulnerability was only patched in iOS 11.4.1. It exploits a Mach port replacement vulnerability in launchd CVE-2018-4280, as well as several smaller vulnerabilities in other services, to execute code inside the ReportCras...

attack_range

Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs — Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...

PT-2026-90433

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram destroy comps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUG ON in zlib code due to missing winbits...

PT-2026-90251

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma rn unregister before rdma destroy id svc rdma free caches rdma-sc cm id-device before teardown, then calls rdma destroy idsc cm id which frees the cm id. rpcrdma rn unregister follows, but between those t...

CVE-2026-82564

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

CVE-2026-82564

CVE-2026-82564 is an Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai (versions 0.6.0 to <1.0.0). In AshAi.Tool.Execution, the identity_filter/3 function built update/destroy filters directly from raw tool arguments. Because a map value is parsed as a predic...

CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

EEF-CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fixed the issue with rcudereferenceprotected. When destroying all sets, we are either in the pernetexit phase or executing a “destroy all sets” command from user space. The latter was taken into account in...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Flush destroywork queue before calling bnx2fcinterfaceput The bnx2fcdestroy function removes the interface before calling destroywork. This causes multiple WARNings from sysfsremovegroup, as the controller rport...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Added functions to register and unregister callback functions for the vblank register. We encountered a kernel panic issue where callback data would become NULL when used in the ovl irq handler. There is a timing...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: The UAF/GPF bug in nilfsmdtdestroy has been fixed. In allocinode, if inodeinitalways fails, it may return -ENOMEM. This failure causes inode-iprivate to remain uninitialized. As a result, nilfsismetadatafileinode returns true...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: dlmfs: Fixed error handling for userdlmdestroyLock. When userdlmdestroyLock fails, it does not clean up the flags it set before exiting. For the USERLOCKINTEARDOWN condition, if this function fails because the lock is...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Prevents handling of any completions after the destruction of a QP Queue Pair. The hardware may generate completions indicating that the QP has been destroyed. The driver should not schedule any completion handlers f...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed a potential double-free issue in createvarref. In createvarref, initvarref is called to initialize the fields of the reffield variable. This variable is allocated in the previous function call, to createhistfield...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fixed the race involving destroyworkonstack. The following debug object splat was observed during testing: ODEBUG: Freeing an active object active state 0: 0000000097d23782; Object type: workstruct; Hint:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: API – Use a work queue in cryptoDestroyInstance. The function cryptoDropSpawn is expected to be called from the process context. However, when an instance is not registered while it still has active users, the last user m...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: devres: A memory leak caused by the driver API devmfreepercpu has been fixed. A memory leak occurs when the driver API devmfreepercpu is used to release memory allocated by devmallocpercpu. This issue was addressed by using...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Fixed a use-after-free in ath9khifusbdisconnect This patch fixes a use-after-free that occurs in ath9khifusbdisconnect, when ath9khifusbdisconnect attempts to access “drvpriv”, which has already been freed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not wait in vain when unloading the module. There is a race condition in the module exit path, where both deleting all controllers and freeing the “leftover IDs” occur simultaneously. To prevent double-freeing, a...