Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: wraparound mbox producer index The driver does not handle the wraparound of the mbox producer index correctly. Currently, the wraparound occurs once the u32 maximum value is reached. Bit 31 of the producer index...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - ntfs: Perform stricter validation of the index block header. The function ntfsindexblockinconsisent has been modified to perform stricter validation of the geometry of the INDEXHEADER in INDX blocks. Additionally, the functi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM – Validated the irqchip index in irqfd routing. Sashiko reported that the irqchip index was not validated for LoongArch. Validation must be added, and irqchip indices outside the range should be rejected, to preven...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntb: ntbhwswitchtec: Fixed array-index-out-of-bounds access The number of MW LUTs depends on the NTB configuration and can be set to MAXMWS. This patch prevents invalid index out-of-bounds access to mwsizes. When an invalid acces...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generated an HTML directory index where each file entry was rendered as a clickable link. If a file existed on the disk whose basename started with “javascript:”, such as “javascript:alert1”,...

NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Sli...

SUSE CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

AZL-97269 CVE-2026-74683 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

AZL-97097 CVE-2026-74635 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemapaddfolio restore index before retrying In filemapaddfolio's split-a-conflict loop, xassetorder is applied repeatedly: each application modifies xas.xaindex, rounding it down according to the splitorder attempte...

CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74683

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

UBUNTU-CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

UBUNTU-CVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemapaddfolio restore index before retrying In filemapaddfolio's split-a-conflict loop, xassetorder is applied repeatedly: each application modifies xas.xaindex, rounding it down according to the splitorder attempte...

CVE-2026-74683 Input: evdev - sanitize event type index when fetching event masks

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

CVE-2026-74683

CVE-2026-74683 is a speculative execution vulnerability in the Linux kernel's evdev input subsystem . The user-supplied event type index passed to the EVIOCGMASK and EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and the client evmasks array in evdev_get_mask()...

EUVD-2026-64572

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

CVE-2026-74635 is an out-of-bounds read in the Linux kernel's fbdev subsystem, specifically in bit_cursor() (drivers/video/fbdev/core/bitblit.c). The function indexes font glyph data using a value from the screen buffer without bounds-checking it against the font's glyph count. A local user can t...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...