Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tpm: Changed to kvalloc in eventlog/acpi.c The following failure was reported on HPE ProLiant D320: 10.693310 T1 tpmtis STM0925:00: 2.0 TPM device-id 0x3, rev-id 0 10.848132 T1 ------------ Cut here ------------ 10.853559 T1...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check the device memory pointer before using it. Add a NULL check before accessing device memory to prevent a crash if the dev-dm allocation in mlx5initonce fails...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: Avoid scanning potential huge holes. When using devmrequestfreememregion and devmmemremappages to add ZONEDEVICE memory, if the end PFN of the requested free memory region is huge e.g., 0x400000000, then nodeendpfn...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: clk: imx93 – fixed a memory leak and the missing unwind goto in imx93clocksprobe. In the function probe, it returns directly without unregistered hws when an error occurs. This issue was fixed by adding goto unregisterhws; on...

CVE-2026-68268

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

CVE-2026-45204 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

CVE-2026-45204 GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

CVE-2026-45204

A vulnerability exists in the GPU DDK where software running as a non-privileged user can conduct improper GPU system calls. This triggers out-of-bounds (OOB) memory access and a kernel null pointer dereference within the DmaTransfer function when pui64Address points to device memory. The null po...

CVE-2026-64377

A double free vulnerability exists in the Linux kernel's qcom-cpufreq-hw driver (Qualcomm CPU frequency hardware). The root cause is that qcom_cpufreq_hw_cpu_exit() calls kfree() on policy->driver_data, which points to memory allocated via devm_kzalloc() in probe(). For the first domain, this ...

CVE-2026-53371

A flaw was found in the Linux kernel's ionic Remote Direct Memory Access RDMA driver. A local user can exploit this vulnerability due to an unbounded read operation when displaying the nodedesc sysfs file. If the nodedesc field is not null-terminated, the system will read beyond its allocated...

Linux Distros Unpatched Vulnerability : CVE-2026-64131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This...

CVE-2025-43892: Buffer Over-read

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitti...

CVE-2026-58583

FluxInk formerly Sunia SPB Peripheral Color Management Driver TcnPeripheral64.sys 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Block: Add a pgmap check to biovecphysmergeable. biovecphysmergeable is used in the request merge, DMA mapping, and integrity merge processes to determine whether two physically contiguous BVec segments can be coalesced into one...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/xe: Fixed a memory leak in xedmabufinitobj when allocation failure occurs. When drmgpuvmresvobjectalloc fails, the pre-allocated memory is not freed. Added a call to xebofreestorage before returning an error. xedmabufinito...

CVE-2026-46280

In the Linux kernel, the following vulnerability has been resolved: lib: testhmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmmtest fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special...

EUVD-2026-35145

In the Linux kernel, the following vulnerability has been resolved: lib: testhmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmmtest fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special...

CVE-2026-46280

CVE-2026-46280 affects the Linux kernel in the HMM selftest path for device memory (dmirror) handling. The root cause is in dmirror_fops_release(), which frees the dmirror struct without migrating device-private pages back to system memory, leaving a stale zone_device_data pointer. If a fault occ...

Linux Distros Unpatched Vulnerability : CVE-2026-46280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib: testhmm: evict device pages on file close to avoid use-after-free Patch series Minor hmmtest fixes and cleanups. Two bugfixes a cleanup for the HMM kernel...

AZL-88812 CVE-2026-46115 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovecphysmergeable biovecphysmergeable is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently h...