Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: Avoid corrupting the page-mapping in hugetlbmcopyatomicpte. In the MCOPYATOMICCONTINUE case with a non-shared VMA, the pages in the page cache are stored in the ptes. However, hugepageaddnewanonrmap is called for thes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mm/khugepaged: fixed -anonvma race condition If an -anonvma is attached to the VMA, the collapseandfreepmd function requires it to be locked. Page table traversal is allowed under any of the following conditions: the mmap lock...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksm: The range-walk function is used to bypass holes in scangetnextrmapitem. Currently, scangetnextrmapitem walks every page address in a VMA to locate mergeable pages. This approach becomes highly inefficient when scanning large...

Linux Distros Unpatched Vulnerability : CVE-2026-72357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong...

CVE-2026-68265

CVE-2026-68265 affects the Linux kernel, specifically the drm/xe/vm path. The issue arises when prefetching a BO VMA in the region DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC, where the code uses the value as an index into region_to_mem_type[], causing an out-of-bounds access (value is -1). The remediatio...

CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

CVE-2026-64310

CVE-2026-64310 is a denial-of-service flaw in the Linux kernel's crypto: ccp component (AMD Secure Encrypted Virtualization). When SEV initialization fails while KVM is actively running VMs, a local user with access to /dev/sev can trigger SEV-only ioctls (e.g., SEV_PDH_GEN). The buggy sev_move_t...

CVE-2026-53373

A flaw was found in the Linux kernel's memory management mm/vma component. When the mmapprepare hook is invoked from an mmap operation, it can attempt to unmap a Virtual Memory Area VMA that is not fully established and already detached. This problematic behavior can lead to a warning in...

CVE-2026-64131

In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...

CVE-2026-64131

In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...

CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...

CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-63953 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage When migratevmainserthugepmdpage jumps to unlockabort due to a PMD check failure, the pgtable allocated earlier via pteallocone is never freed, causing a memory...

CVE-2026-53373

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...

CVE-2026-53373

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...

CVE-2026-53373 mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...