CVE-2019-18885

CVE-2019-18885 CVE-2019-18885 bobfuzzer Team Members Infomations Overview Target Reproduce Bug Causes Debugger View KASAN Logs Acknowledgments bobfuzzer project team in BoBa.k.a Best of the Best, Republic of Korea. [email protected] finding bugs in linux kernel filesystem modules Team Member...

CVE-2020-0423

Big thank you to all the other security research people publishing their work, allowing others to learn, and do independent research. Resources: Original exploit article via longterm.io: https://www.longterm.io/cve-2020-0423.html Repo from Github user 20000s, also looking into 2020-0423:...

UBUNTU-CVE-2026-99272

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

CVE-2026-99272

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

CVE-2026-99272

The Linux kernel contains a vulnerability in the SMB client where SMB2_read() fails to validate that the data range lies within the actual received response. Specifically, it copies DataLength bytes from a response without verifying the bounds of the receive object. A malicious server can provide...

EUVD-2026-119290

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

Linux Distros Unpatched Vulnerability : CVE-2026-99272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lie...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that reference before btacceptunlink, leaving only the queue reference...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks; its inner loop is bounded solely by the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor retrieves the glyph under the cursor using c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is enabled. The...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, along with three temperature source and temperature source configuration registers. The register...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races The blame commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack functions which were later renamed/interfaced to netdevhold...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherits neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are initiated during sndusbmidiv2create. A subsequent setup failure may still trigger sndusbmidiv2free, which currently frees each endpoint and its...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues struct nsimrq embed their own struct napistruct. When queue reset is performed e.g., via queuereset debugfs, nsimqueuestart swaps in a newly...

kernel-sanitizers

Linux Kernel Sanitizers Note: Most Sanitizers are maintained in the Linux kernel repository and are not hosted here. This repository contains out-of-tree information and prototypes for KASAN, UBSAN, KCSAN, KFENCE, KMSAN, and KTSAN. Note, that KMSAN's code is hosted separately. Questions about KAS...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: avoid invalid natnet pointer use on failed nfnatinit We ran into below KASAN splat, which is mostly uninteresting, beside for having nfnatregisterfn in the call chain as a cause for the offending access:...