kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

AZL-104826 CVE-2026-97581 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

CVE-2026-97581

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

AZL-104541 CVE-2026-97578 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchipvpu981av1decsettileinfo divides contextupdatetileid by tileinfo-tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds...

EUVD-2026-86889

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

CVE-2026-97581 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

CVE-2026-97578

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchipvpu981av1decsettileinfo divides contextupdatetileid by tileinfo-tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds...

ROS-20260925-73-0004

The vulnerability of the slimproi2cblkwr function in the Linux kernel’s drivers/i2c/busses/i2c-xgene-slimpro.c file is related to the lack of control over the valid range of the value that can be passed to the “data-block0” variable. This value ranges from 0 to 255; without proper validation, thi...

CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

EUVD-2026-80465

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

CVE-2026-89865

CVE-2026-89865 affects the Linux kernel's qla2xxx SCSI driver (QLogic). The FRU and I2C bsg handlers stage transfers in a 256-byte DMA bounce buffer allocated via dma_pool_alloc() , which does not zero the memory. Only a small leading prefix is initialized (e.g., 36 bytes for a FRU version, 1 byt...

CVE-2026-89853 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

CVE-2026-89853: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

PT-2026-93494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the qla2xxx SCSI driver. The function qla2x00 free fce trace frees and clears the ha-fce variable while holding only the fce mutex. However, the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fixed NULL pointer dereferencing in sanitycheck. If mockchain returns NULL due to a memory allocation failure, it is passed to dmafenceenableswsignaling, resulting in a NULL pointer dereferencing there. Call...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: udmabuf: Set the DMA mask for the udmabuf device v2 If the DMA mask is not set explicitly, the following warning occurs when the userspace attempts to access the dma-buf via the CPU, as reported by syzbot: WARNING: CPU: 1 PID:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dma-buf: A memory barrier should be inserted before updating numfences. smpstoremb inserts a memory barrier after storing data. This differs from what the comment originally intended; a null pointer dereferencing can occur if the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput on failed usercopy If the copy back to userland fails for the FASTRPCIOCTLALLOCDMABUFF ioctl, we should not assume that ‘buf-dmabuf’ is still valid. In fact, dmabuffd calls fdinstall before, there...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb-storage: alauda: Fixed an issue where an uninitialized value was used in alaudacheckmedia. Syzbot reported that KMSAN complained about accessing an uninitialized value within the alauda subdriver of usb-storage. Bug: KMSAN...