kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

CVE-2026-99220

A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a...

Veeam Software Appliance Fails to Boot with Kernel Panic on AMD EPYC Hosts

Challenge A Veeam Software Appliance Linux-based Veeam Backup & Replication virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel. The following kernel panic occurs during earl...

Critical: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

UBUNTU-CVE-2026-99220

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock CVE-2026-43499 — Redmi 9A / 9C dandelion port...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling The Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT or ISOEND packets. Currently, we reject them if they are the last packet. If the controller sends a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames; a corrupted...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can cause this addition to exceed pelen, resulting in ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix NULL dereference in ffapartitioninfoget ffapartitioninfoget passes uuidstr directly to uuidparse without performing a NULL check. When a caller passes NULL, uuidparse - uuidparse - uuidisvalid dereferences t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index without any depth limit. A specially crafted NTFS image containing circular index node references leads t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio’s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG Direct writes to unwritten extents can cause the kernel to panic in ocfs2assuretranscredits when the journal aborts during DIO completion. This crash is a general...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check the return value of rpcsockaddr2uaddr in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking whether it is NULL. rpcsockaddr2uaddr return...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ According to the report by Jaeyoung Chung: “spearadcprobe in drivers/iio/adc/spearadc.c registers its interrupt handler with devmrequestirq before it initializes...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without performing a NULL check; however, this helper returns NULL when the receiving device has no...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y and the command line “userdebug=31” is set, a user fault may trigger showpte without any lock. If another thread in the same process...