CVE-2026-52972 crypto: af_alg - Cap AEAD AD length to 0x80000000

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000...

CVE-2026-52972

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000...

CVE-2026-52972

The Linux kernel cryptographic subsystem contains a vulnerability in the crypto/af_alg.c module's af_alg_cmsg_send() function. The issue is caused by an integer overflow (or cyclic shift) during TX buffer size checks, which could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-52972 crypto: af_alg - Cap AEAD AD length to 0x80000000

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000...

CVE-2026-52964

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading...

CVE-2026-52964

Summary of CVE-2026-52964 : A flaw in the Linux kernel’s ALSA USB-audio path (USB MIDI 2.0 endpoint parser) fails to validate descriptor lengths for the MIDI 2.0 endpoint, allowing a malformed device to cause out-of-bounds reads on baAssoGrpTrmBlkID[] due to walking endpoint extras before verifyi...

CVE-2026-52964 ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading...

CVE-2026-52963 ALSA: usb-audio: Bound MIDI endpoint descriptor scans

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans sndusbmidigetmsinfo validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID, but the descriptor walker can still return a class-specific...

CVE-2026-52959

The CVE-2026-52959 issue affects the Linux kernel SEV guest module. During an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer for a host certificate blob and stores its size in report_req->certs_len. The host may return SNP_GUEST_VMM_ERR_INVALID_LEN ...

CVE-2026-52959 virt: sev-guest: Do not use host-controlled page order in cleanup path

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request SVMVMGEXITEXTGUESTREQUEST, getextreport allocates a buffer to retrieve a certificate blob from the host, keeping track ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7925: Fixed possible out-of-band OOB access in mt7925macwritetxwi80211. Check the frame length before accessing the mgmt fields in mt7925macwritetxwi80211 in order to avoid possible OOB access...

Astra Linux – Vulnerability in libsoup3

There is a vulnerability related to request smuggling in LibSoup’s HTTP/1 header parsing logic. The soupmessageheaders.AppendCommon function in libsoup/soup-message-headers.c appends each header value unconditionally, without checking for duplicates or conflicting Content-Length fields. This allo...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Check the length of skb for an unknown CC opcode. In hcicmdCompleteevt, if the command completion event has an unknown opcode, we assume that the first byte of skb-data contains the return status. However, th...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, resulting in a buffer overread. This can allow an attacker to potentially access sensitive information or cause a denial of service at the application level...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. The API function sshgethexa is vulnerable to a denial-of-service attack when processing zero-length inputs. This vulnerability can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication, if the...

Astra Linux – Vulnerability in pyopenssl

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting from version 22.0.0 and before version 26.0.0, if a user provided a callback for setcookiegeneratecallback and the returned cookie value was longer than 256 bytes, pyOpenSSL would cause an overflow of the buffer provided by OpenSS...

Astra Linux – Vulnerability in Erlang

Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in Erlang OTP inets httpd module allows for HTTP requests to be disguised. This vulnerability is associated with the program file lib/inets/src/httpserver/httpdrequest.erl and the routine...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: Check actuallength before accessing the data. The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: Avoid NULL dereferencing on a zero-length gsstoken in gssreadproxyverf A zero-length gsstoken results in pageaddress being == 0, and intoken-pages0 being NULL. The code pageaddressintoken-pages0, which can lea...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: Ring-buffer: A fix was made to check the length of events before using them. Check the length of events before adding them for accessing the next index in rbreaddatabuffer. Since this function is used to validate possibl...