CVE-2026-77860

A vulnerability in Unbound's serve-expired code path allows a remote attacker to bypass pending-query limits using specially crafted DNS queries. By causing a security counter to double-decrement, the attacker can hold an arbitrary number of pending queries from a single source, resulting in a...

AZL-101718 CVE-2026-77860 affecting package unbound for versions less than 1.26.1-1

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

DEBIAN-CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

UBUNTU-CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860 'serve-expired' can bypass Unbound 'wait-limit'

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

EUVD-2026-80286

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-77860: Multiple Operations on Resource in Single-Operation Context

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

Linux Distros Unpatched Vulnerability : CVE-2026-77860

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' count...

Astra Linux – Vulnerability in Linux 5.10

A flaw was discovered in btrfsgetrootref in fs/btrfs/disk-io.c within the btrfs filesystem of the Linux kernel, due to a double decrement of the reference count. This issue may allow a local attacker with user privileges to crash the system or may lead to the leakage of internal kernel informatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Fix for the double decrement of the dirty clusters count during shutdown. The fstests test for generic/388 occasionally produces a warning in ext4putsuper, associated with the count of dirty clusters: WARNING: CPU: 7; PID:...

Linux Distros Unpatched Vulnerability : CVE-2026-80911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double...

AZL-99470 CVE-2026-80911 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

EUVD-2026-71614

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

CVE-2026-80911 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

CVE-2026-80911

CVE-2026-80911 affects the Linux kernel ASoC SOF (Sound Open Firmware) audio driver. The vulnerability resides in the error path of sof_widget_setup_unlocked() . When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, sof_widget_free_unlocked() is called twice, cau...

CVE-2026-80911: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...