CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

UBUNTU-CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

EUVD-2026-55596

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005095 advisory. In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb syzkaller reported use-after-free in...

media: xc2028: avoid use-after-free in load_firmware_cb()

...

CVE-2022-49881 wifi: cfg80211: fix memory leak in query_regdb_file()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix memory leak in queryregdbfile In the function queryregdbfile the alpha2 parameter is duplicated using kmemdup and subsequently freed in regdbfwcb. However, requestfirmwarenowait can fail without calling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: xc2028: Avoid use-after-free in loadfirmwarecb Syzkaller reported a use-after-free in loadfirmwarecb 1. The reason is that the module allocated a struct tuner in tunerprobe, and then the module initialization failed, causi...

SUSE CVE-2024-43900

In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb syzkaller reported use-after-free in loadfirmwarecb 1. The reason is because the module allocated a struct tuner in tunerprobe, and then the module initialization failed, the...

DEBIAN-CVE-2024-43900

In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb syzkaller reported use-after-free in loadfirmwarecb 1. The reason is because the module allocated a struct tuner in tunerprobe, and then the module initialization failed, the...

AZL-48231 CVE-2024-43900 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb syzkaller reported use-after-free in loadfirmwarecb 1. The reason is because the module allocated a struct tuner in tunerprobe, and then the module initialization failed, the...

UBUNTU-CVE-2024-43900

In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb syzkaller reported use-after-free in loadfirmwarecb 1. The reason is because the module allocated a struct tuner in tunerprobe, and then the module initialization failed, the...