CVE-2026-25589-25588-25243-23631-23479-REDIS

Redis 5件のCVEに対するテスト・修正ガイド（2026.05.08時点） 公開日: 2026-05-08 著者: TonyCao [email protected] 出典: Redis Security Advisory 目次 1. 概要 2. 影響を受けるバージョン 3. 各CVEの詳細 CVE-2026-23479 — Unblock Client FlowにおけるUse-after-free CVE-2026-25243 — RESTOREにおけるInvalid Memory Access CVE-2026-25588 — RedisTimeSeries...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098745)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098745 advisory. In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098675 advisory. In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown Hongyu reported a hang on kexec in a VM...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i40e: Fixed potential invalid access when the MAC list is empty. The listfirstentry function never returns NULL—if the list is empty, it still returns a pointer to an invalid object, resulting in potential invalid memory access...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: In the readstring function, the sensor index is checked. A potential invalid memory access occurs when the requested sensor is not found. findecsensorindex may return a negative value e.g., -ENOENT, but its result is used...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an invalid prog-stats access when updateeffectiveprogs fails. The issue occurs due to a fault-injected code sequence in updateeffectiveprogs. The problem can be described as follows: c cgroupbpfdetach...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the handling of offloads in ipgre.c, there is a possibility of a page fault due to an invalid memory access. This could lead to the disclosure of local information without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android Versions...

CVE-2026-74322

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability allows an attacker to trigger an invalid memory access when processing specific Wi-Fi frames. This can lead to a system crash, resulting in a Denial of Service DoS for affected systems...

CVE-2026-72460

A flaw was found in the Linux kernel's AppArmor security module. When changing a security profile, the aachangeprofile function might attempt to use an invalid security label before properly checking if the label was successfully created. This oversight could allow a local attacker to trigger a...

CVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-72146 dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-72146 dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-25589

A flaw was found in RedisBloom. An authenticated attacker with permission to execute the RESTORE command on a Redis server with the RedisBloom module loaded can supply a crafted serialized payload that causes an invalid memory access due to an improper validation of serialized values processed...

CVE-2026-68172

A flaw was found in the Linux kernel, specifically within the hugeptepget helper function for the arm64 architecture. When this function is provided with an unaligned virtual address, it can incorrectly process Page Table Entries PTEs. This can lead to the kernel dereferencing invalid memory...

CVE-2026-68230 media: amlogic-c3: Add validations for ae and awb config

In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if the zonesnum is bigger than zoneweight. This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:1...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: In the send operation, it is necessary to check for inline extents within the rangeisholeinparent function. Before accessing the diskbytenr field of a file extent item, we need to check whether we are dealing with an inlin...

PYSEC-2026-1909 Sentencepiece has a a heap overflow issue

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure...

redis: RESTORE invalid memory access may allow remote code execution

A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitra...

redis: RESTORE invalid memory access may allow remote code execution

A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitra...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40263)

In the Linux kernel, the following vulnerability has been resolved: Input: croseckeyb - fix an invalid memory access If croseckeybregistermatrix isn't called due to buttonsswitchesonly in croseckeybprobe, ckdev-idev remains NULL. An invalid memory access is observed in croseckeybprocess when...