Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel through version 5.11.3, when it was used with Xen PV. A certain part of the netback driver lacks proper handling of errors, such as failed memory allocations as a result of changes to the way errors related to grant mapping are handled. A denial-of-servi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: m920x: A potential memory leak has been fixed in m920xi2cxfer. The “read” function is freed when it is determined to be NULL, but not when a read error occurs. The logic has been revised to avoid a small leak in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/msm: fixed NULL dereferencing when uninstalling an interrupt. In cases of early initialization errors, and on platforms that do not use the DPU controller, the deinitialization code can be called with the kms pointer set t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: crypto: sun8i-ce-cipher – Fixed error handling in sun8icecipherprepare. Fixed two DMA cleanup issues on the error path in sun8icecipherprepare: 1. If dmamapsg fails for areq-dst, the device driver will attempt to free DMA memo...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/tls: Fixed the reversed sign in calls to tlserrabort. sk-skerr seems to expect a positive value. This convention is not always followed by ktls, which can lead to memory corruption in other code. For example: c kworker...

Astra Linux – Vulnerability in curl

When curl is instructed to use the Certificate Status Request TLS extension, also known as OCSP stapling, to verify that the server certificate is valid, it may fail to detect certain OCSP issues and instead incorrectly consider the response to be fine. If the returned status reports an error oth...

Astra Linux – Vulnerability in Firefox

JIT compilation errors in the JavaScript: WebAssembly component. This vulnerability has been fixed in Firefox 152 and Thunderbird 152...

Astra Linux – Vulnerability in Firefox and Thunderbird

The error page for sites with invalid TLS certificates lacked the activation-delay feature provided by Firefox to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page triggered user clicks at specific locations immediately before...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: mana: Fixed error handling for TX CQE messages. For an unknown type of TX CQE error likely due to newer hardware, still free the SKB, update the queue tail, etc. Otherwise, the accounting data will be incorrect...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: CIFS: A connection leak occurs when the tlink setup fails. If the tlink setup fails and connections are lost, then the refcnt leak occurs due to the cifsd kthread not exiting. Additionally, fscache information is also leaked...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear stagedconfig before and after it is used. As a temporary storage, stagedconfig in rdtdomain should be cleared before and after it is used. The stale value in stagedconfig could cause an MSR access error. Here i...

Astra Linux – Vulnerability in linux-astra-modules-5.10, linux-astra-modules-5.15, linux-astra-modules-6.1

The vulnerability of Linux Astra Modules relates to errors during thread blocking. Exploiting this vulnerability allows an attacker to compromise data integrity and also cause service failures through the use of a specially created file system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: phy: qcom-qmp: fixed the issue where the struct clk structure was leaked during probe errors. Be sure to release the pipe clock reference in case of a late probe error e.g., probe deferral...

cups-filters security update

1.20.0-36.0.1.el810.1 - header/footer not being printed in banner page. Orabug: 28265099 [email protected] - Fixes Orabug: 29163824 source indentation not following convention [email protected] 1.20.0-36.1 - CVE-2026-64612 cups-filters: Handle libpng errors via longjmp/setjmp...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

CVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72096

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corruptederrs" was not atomic, thus it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...

UBUNTU-CVE-2026-72096

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corruptederrs" was not atomic, thus it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...

CVE-2026-72096

CVE-2026-72096 affects the Linux kernel’s dm-verity component, where the error counter v->corrupted_errs was not atomic, potentially causing race conditions. This could allow the call to dm_audit_log_target("max-corrupted-errors") to be skipped due to races. The issue has been resolved in the ...

CVE-2026-72096 dm-verity: make error counter atomic

In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error counter "v-corruptederrs" was not atomic, thus it could be subject to race conditions. The call to dmauditlogtarget"max-corrupted-errors" may be skipped due to the races...