Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: aio: Fixed a use-after-free issue due to missing POLFREE handling. signalfdpoll and binderpoll are special because they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hwmon: coretemp Simplified platform device handling Coretemp’s platform driver is unconventional. All the actual processing is performed globally by the initcall and CPU hotplug notifiers. The “driver” essentially just wraps t...

PT-2026-79636

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc rx splice smc rx splice passes pages to splice to pipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice to pipe may...

CVE-2026-72282

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. The kvmiobusgetdev function, responsible for retrieving I/O bus devices, could return a device that is only matched by its memory address. This creates a race condition where the device might be deallocated before...

ANT-2026-CM0TCREP · torvalds/linux · Use-After-Free

use-after-free high CVE-2026-43074 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CM0TCREP: UAF in epgetupwardsdepthproc giving unprivileged LPE During epollctlA, EPOLLCTLADD, B, the nesting-depth check...

CVE-2026-72282

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72245

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1xdeviceparsedt error path After deviceinitialize, the embedded struct device in struct host1xdevice should be released through the device core with putdevice. In host1xdeviceadd, if...

CVE-2026-72282

The CVE-2026-72282 entry concerns the Linux kernel KVM path: kvm_io_bus_get_dev() now requires the caller to hold the srcu lock, moving locking responsibilities to the caller. The function returns a device matched only by address, which can lead to a lifetime issue if the device’s type isn’t as e...

PT-2026-72470

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm io bus get dev locking responsibilities to callers kvm io bus get dev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected...

PT-2026-71960

Name of the Vulnerable Software and Affected Versions OutSystems Service Center versions prior to 11.41.2 OutSystems Lifetime versions prior to 11.28.2.3955 Description OutSystems Service Center is subject to a DOM-based Cross-Site Scripting XSS issue, where a low-privileged attacker can execute...

CVE-2026-68383

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q-name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xegucexecqueue so ...

CVE-2026-68382

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

UBUNTU-CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

UBUNTU-CVE-2026-68266

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

CVE-2026-68383

CVE-2026-68383 affects the Linux kernel drm/xe/guc component. The vulnerability arises because the scheduler keeps a pointer to the timeline name, but q->name is freed when the exec queue is freed while scheduler fences can still reference it, leading to a use-after-free. The published fix sto...

EUVD-2026-55569

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q-name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xegucexecqueue so ...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68382

CVE-2026-68382 relates to the Linux kernel drm/xe/guc driver. The issue is a race during asynchronous destruction of GuC execution queues: if the final device reference is released while destruction is still pending, DRM cleanup may drain the same workqueue and deadlock. Mitigation implemented in...