UBUNTU-CVE-2026-43496

In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg...

CVE-2026-43496 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg...

CVE-2026-43496

CVE-2026-43496 affects the Linux kernel net/sched subsystem (sch_red). When red qdiscs with children (e.g., qfq) perform a peek() to expose an skb and then immediately dequeue from the child, the code path could dereference NULL and trigger a kernel panic. The fix changes the sequence from direct...

EUVD-2026-31274

In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg...

CVEs

NULL Dereference The vulnerabilities found in cryptofioctl...

CVE-2026-43496: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath12k: The ab pointer is passed directly to ath12kdptxgetencaptype. In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. During the vdev delete sequence, arvif-ar might become NULL, which...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, swap: restore swapspace attribute to avoid kernel panic The commit 8b47299a411a “mm, swap: make swap address space read-only and add context debug check” made the swap address space read-only. This may lead to kernel panic if...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Octeontx2-af: Added proper checks for fwdata. Firmware populates the MAC address, link modes supported, advertised, and EEPROM data in the shared firmware structure. Kernel access is allowed via the MAC block CGX/RPM. Accessin...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Marking the splash memory region as reserved. A reserved memory region was added for the framebuffer memory the splash memory region set up by the bootloader. This fix resolves a kernel panic...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Firmware: stratix10-rsu: Fixed a NULL pointer dereference issue when RSU is disabled. When the Remote System Update RSU is not enabled in the First Stage Boot Loader FSBL, the driver encounters a NULL pointer dereference when...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm: renesas: rz-du: mipidsi: Fixed a kernel panic that occurred when rebooting certain panels. Since commit 56de5e305d4b “clk: renesas: r9a07g044: Added MSTOP for RZ/G2L”, we may encounter the following kernel panic when...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: blk-mq: Fixed the issue where blkmqtags double-freeed memory when nrrequests increased. In cases where user-triggered tags increase due to the nrrequests value in the queue sysfs attributes, hctx-schedtags will be directly freed...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ionic: Fix kernel panic in XDPTX action In the XDPTX path, the ionic driver sends a packet to the TX path along with the rx page and the corresponding DMA address. After the TX operation is completed, the ionictxclean function...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed by removing the unnecessary f2fsbugon function to avoid panics. The verifyblkaddr function will trigger a panic once we introduce a fault into f2fsisvalidblkaddr; this unnecessary f2fsbugon function has been remove...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Net: wangxun – fixed a kernel panic caused by a null pointer. When the device uses a custom subsystem vendor ID, the function wxswinit returns before the memory of ‘wx-mactable’ is allocated. A null pointer will cause the kernel...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mmc: davincimmc: Prevents the transmitted data size from exceeding the length of sgm. No check is performed on the size of the data to be transmitted. This can lead to a kernel panic when the transmitted data size exceeds the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: spi: spi-qpic-snand: reallocation of BAM transactions When using the mtdnandbiterrs module to test the driver, occasional issues arise, such as the following: 1. The swiotlb mapping fails with the following message: 85.926216...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/msgring: A NULL pointer dereference occurred in iomsgsendfd. Syzkaller produced the following call trace: BUG: KASAN: NULL pointer dereference in iomsgring+0x3cb/0x9f0 A value of 8 was written to address 0000000000000070 ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rcv: fixed the runtime constant support for nommu kernels The runtimefixup32 function does not handle the case where val is zero correctly as may occur when patching a nommu kernel and referring to a physical address below the 4G...