kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

EUVD-2026-120492

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

CVE-2026-90591 NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

CVE-2026-90591 NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte bounce buffer obtained via dmapoolalloc, which does not zero out the allocation. They...

CVE-2026-89865

A flaw was found in the Linux kernel's qla2xxx SCSI driver. The FRU and I2C bsg handlers, responsible for data transfers, utilize a DMA Direct Memory Access buffer that is not fully cleared upon allocation. A local attacker could exploit this by manipulating the transfer length in the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg, which maps this buffer directly for DMA. When the DMA mapping flushes o...

CVE-2026-93118

A flaw was found in the Linux kernel's USB gadget driver for Aspeed UDC. During the device initialization process, a failure to allocate a Direct Memory Access DMA buffer is not properly handled. This can lead to the driver attempting to use an invalid memory address, potentially causing a system...

CVE-2026-98486

A flaw was found in the Linux kernel's Amazon Elastic Network Adapter ENA driver. When the driver encounters an error during device initialization, it fails to release an allocated Direct Memory Access DMA buffer. A local user capable of triggering repeated device probe failures could exploit thi...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked; then manahwchandleresp re-reads the same field from the same DMA...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmpnvmem: Fix buffer size in DMA and memcpy The buffer size used in dma allocation and memcpy is incorrect. This can result in undersized DMA buffer access and potential memory corruption. Use the correct buffer size in...

SUSE CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

DEBIAN-CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

UBUNTU-CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

EUVD-2026-103815

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.17.3 to 6.18 and version 6.18 have security vulnerabilities. These vulnerabilities stem from an error in the macballoc function, where the Tx and Rx buffers that have been allocated are not promptly stored in bp-queues0. As a result, during error handling, these...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck If due to a memory allocation failure mockchain returns NULL, it is passed to dmafenceenableswsignaling resulting in NULL pointer dereference there. Call...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot caused KMSAN to complain about accessing an uninitialized value within the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alaudatransport+0x462/0x57f0...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: udmabuf: Set the DMA mask for the udmabuf device v2 If the DMA mask is not set explicitly, the following warning occurs when the user space attempts to access the dma-buf via the CPU, as reported by syzbot: WARNING: CPU: 1 PID...