Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR retains its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node ID...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched/psi: Shut down rtpolltimer in psicgroupfree psischedulertpollwork is called locklessly from the scheduler hotpath and can race psitriggerdestroy taking down the last rtpoll trigger under rtpolltriggerlock:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace The bounce pages are not necessarily page-aligned; thus, current VDUSE can leak kernel information by mapping bounce pages to userspace. Allocate bounce pages using GFPZERO to prevent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter ‘k’ can theoretically lead to a NULL pointer dereference of ‘rawdata’. If the loop execute...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Strengthen checks on cgroup storage cookies for prog arrays The fix in commit abad3d0bad72 “bpf: Fix oob access in cgroup local storage” is still incomplete. The compatibility check for prog arrays treats a program lacking...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound; they then set udataoffset to a fixe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues raises the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn’t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list The RMID of a pseudo-locked group is freed upon its creation. When unmounted, rmdirallsub unconditionally frees all RMIDs of all groups, resulting in a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint’s wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

exploit-t-platform

Exploit-t Platform Practical-risk vulnerability prioritisatio...

kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.45 fixes various security issues: The following security issues were fixed: CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize bsc1269766. CVE-2026-53381: virtiofs: fix UAF on submount umount bsc1271837. CVE-2026-63968: ipv...

Exploit for CVE-2026-115904

CVE-2026-115904 — OS Command Injection via openExternalLinks...

CVE-2026-99189

A flaw was found in the Linux kernel's General-Purpose Input/Output GPIO MXC driver. This vulnerability can result in a Denial of Service DoS through a system crash if an interrupt arrives while the device is initializing. Because the interrupt handler is registered before its required data...