Linux Distros Unpatched Vulnerability : CVE-2026-93316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

CVE-2026-105790: Server-Side Request Forgery (SSRF)

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-93316

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

CVE-2026-93316

The BuildKit daemon is vulnerable to a daemon panic when it is started with the --cdi-disabled flag and subsequently processes builds that attempt to use CDI devices . This issue, categorized as a NULL Pointer Dereference (CWE-476) , can occur either accidentally or maliciously. The impact is a h...

CVE-2026-93316 Starting daemon with --cdi-disabled flag can lead to panic on specific builds

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

CVE-2026-93316 Starting daemon with --cdi-disabled flag can lead to panic on specific builds

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

CVE-2026-6789-Stack-Buffer-Overflow-in-Embedded-TLS-Certificate-Parser

9. CVE-2026-6789 – Stack Buffer Overflow in Embedded TLS Certificate Parser Overview A popular lightweight TLS library simulated contains a stack buffer overflow when parsing X.509 certificate Subject Alternative Name extensions with a crafted length field. Severity: Critical RCE on IoT/Industria...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ice: Don't double unplug aux on peer initiated reset In the IDC callback that is accessed when the aux drivers request a reset, the function to unplug the aux devices is called. This function is also called in the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hwmon: coretemp Simplified platform device handling Coretemp’s platform driver is unconventional. All the actual processing is performed globally by the initcall and CPU hotplug notifiers. The “driver” essentially just wraps t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: The EEPROM and OTP sizes for PCI1xxxx devices have been modified. The maximum OTP and EEPROM sizes for PCI1xxxx devices are 8 Kb and 64 Kb respectively. The maximum size definitions have been adjusted, and the corre...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa – Set dmamask for FFA devices. Setting dmamask for FFA devices is necessary; otherwise, DMA allocation using the device pointer may lead to the following warning: WARNING: CPU: 1, PID: 1, at...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Rejects invalid file types when reading inodes. To prevent inodes with invalid file types from causing malfunctions or assertion failures, a missing sanity check should be added when reading an inode from a block device. ...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: Fixed a use-after-free issue during the driver unbind operation. The driver allocates and registers two platform device structures during the probe phase. However, these devices were never deregistered after...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm raid: fixed access issues beyond the end of the raid member array. When the dm-raid table is loaded using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is determined by the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nfc: fixed a segfault in nfcgenldumpdevicesdone When kmalloc in nfcgenldumpdevices fails, nfcgenldumpdevicesdone causes a segfault as follows: KASAN: null-ptr-deref in range 0x0000000000000008-0x000000000000000f CPU: 0 PID: 25...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mfd: intelsocpmicbxtwc: Use the IRQ domain for TMU devices. While the idea of adapting the driver to utilize the hierarchy of IRQ chips is correct from a design perspective, the implementation contains flaws. This issue was...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

Guests running on Arm can cause Denial of Service DoS attacks on Dom0 through PV devices. When mapping memory pages of guests on Arm, Dom0 uses an rbtree to keep track of the foreign mappings. The update of this rbtree does not always occur completely with the relevant lock held, resulting in a...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Two use-after-free operations in ibmasminitone have been fixed. In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bonding: The device was stopped in the bondsetupbyslave function. The commit 9eed321cde22 “net: lapbether: only support Ethernet devices” managed to keep syzbot away from net/lapb until today. In the following issue 1, a lapbethe...

Astra Linux – Vulnerability in Chromium

Incorrect security user interfaces in Page Info in Google Chrome on iOS prior to version 88.0.4324.96 allowed a remote attacker to spoof the security user interface through a crafted HTML page...