Linux fbdev sm501fb Buffer Overflow

The vulnerability of the drivers/video/fbdev/sm501fb.c component of the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Linux kernel Set RQ Size Buffer Overflow

The vulnerability of the setrqsize function in the drivers/infiniband/hw/mlx5/qp.c component of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the nvmenshead structure in the drivers/nvme/host/core.c kernel of the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the pfcplinksetup function in the drivers/net/pfcp.c component of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: hifusb: Do not dereference hifdev after re-arming the firmware request The ath9khifrequestfirmware function re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: Added guards for HIDCLAIMEDINPUT in raw event callbacks; these guards were previously missing. In commit 2ff5baa9b527 “HID: appleir: Fix potential NULL dereference at raw event handling”, we addressed the issue where raw eve...

Astra Linux - vulnerability in linux

In various methods of kernel base drivers, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local privilege escalation requiring System execution privileges. No user interaction is required for exploitation. Product: Android Versions: Android kernel Androi...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SoundWire: Revisiting the driver’s bind/unbind operations and callbacks In the SoundWire framework, we store a pointer from the driver operations in the “slave” structure. This can lead to kernel errors when unbinding codec...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: cadence: Check for the existence of cdnspcie::ops before using it cdnspcie::ops may not be populated by all Cadence glue drivers. This is the case for the upcoming Sophgo platform, which does not set the ops. Therefore, add ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘thermal/drivers/hwmon: Cleanup coding style a bit’” The commit 030a48b0f6ce “thermal/drivers/hwmon: Cleanup coding style a bit” introduced a use-after-free in the error path of thermaladdHWMonsysfs, by removing a valid...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: The issue with ucan now has a corrected handling of the lifetime of device resources. USB drivers bind to USB interfaces, and any device’s managed resources should have their lifetime tied to the interface, rather than the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers:md: fix a potential use-after-free bug At line 2884, the statement "raid5releasestripesh;" removes the reference to sh, which may cause sh to be released. However, sh is later used in line 2886, where it appears in the...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt7-sdw: harden jackdetecthandler Realtek headset codec drivers typically check whether the card is instantiated before proceeding with the jack detection. However, the rt700, rt711, and rt711-sdca versions lack a check on...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: phy: It is now possible to allow the MDIO bus’s PM operations to initiate/stop the state machine for the phylink-controlled PHY. There are two types of DSA drivers: 1. Those that call dsaswitchsuspend and dsaswitchresume...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fixed error checking in probe This code accidentally called thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. The call was moved to a later stage to avoid dereferenci...

USN-8922-2 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - IIO ADC drivers; - Multiple devices driver; - PCI subsystem; - VFIO drivers; - Network file...

USN-8922-2: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - S390 architecture; - IIO ADC drivers; - Multiple devices driver; - PCI subsystem; - VFIO drivers; - Network file...

Microsoft Windows Kernel-Mode Drivers Use-After-Free / Privilege Escalation

Microsoft Windows Kernel-Mode Drivers contain a use-after-free in Frame Server stream handling that allows an authorized local attacker to elevate privileges. The proof of concept races stream publishing and closure to obtain SeDebugPrivilege and launch a command shell...

CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-75085

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...