OutOfTune

OutOfTune Inspired by the original Pytune, OutOfTune registers a rogue device in Entra ID, enrolls it into Intune MDM, and checks the resulting compliance state. Only supports Windows devices as this was my main goal, might add additional ones in the future. Accompanying blog:...

CVE-2026-99019

A flaw was found in the Linux kernel's SCSI changer driver, which can lead to a Denial of Service DoS. The driver retains unreleased device references after reading changer configuration data, preventing removed devices from being properly cleaned up. An attacker or local user interacting with SC...

CVE-2026-98620

A flaw was found in the Linux kernel's MediaTek Ethernet driver mtkethsoc. This issue allows a local attacker to cause a Denial of Service DoS by triggering a failure during the network device registration probe sequence. When registration fails, the driver's error cleanup path frees registered...

DEBIAN-CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

EUVD-2026-103835

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750

The Linux kernel contains a vulnerability in the tty subsystem where a race condition between closing a TTY (saving its termios) and the re-registration of a device can occur. This happens when a minor number is reused for a different device, potentially leading to a use-after-free condition. To ...

Linux Distros Unpatched Vulnerability : CVE-2026-98750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different...

CVE-2026-98750: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.12 has a security vulnerability. This vulnerability arises from the failure to reset the saved termios state during device registration. Additionally, some TTY drivers do not ensure that the next device number is no longer used. When the TTY is closed and termios is...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hns: Fixed a possible memory leak in hnaeaeregister. When a fault is injected while probing a module, if deviceregister fails, but the refcount of the kobject is not decreased to 0, the name allocated in devsetname may be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcildisc,serdev: failure in checking percpuinitrwsem syzbot reports a NULL pointer dereferencing at hciuartttyclose 1. For rcusyncenter, percpuinitrwsem is called without rcusyncinit, because hciuartttyopen ignores...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: siox: fix possible memory leak in sioxdeviceadd If deviceregister returns an error in sioxdeviceadd, the name allocated by devsetname must be freed. According to the comment in deviceregister, it should use putdevice to release t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: axi-fan-control Fixed a possible NULL pointer dereferencing issue. axifancontrolirqhandler, which depends on the private axifancontroldata structure, might be called before the hwmon device is registered. This could lead t...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix kernel panic caused by incorrect error handling The error path when failing to register devices on the TEE bus contains a bug that leads to a kernel panic as follows: 15.398930 Unable to handle kernel paging reque...

CVE-2026-105790

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105790

Prior to version 3.0.9 , the Microsoft UFO framework is vulnerable to a Server-Side Request Forgery (SSRF) . Authenticated device registration via /api/devices allows an attacker to provide a controlled WebSocket endpoint. Because aip/transport/websocket.py only applies pinned_addresses to the in...