CVE-2026-53104

CVE-2026-53104 concerns Linux kernel code for MT76 wireless (wifi) where a memory leak occurs in MT76 RX queue cleanup and page_pool handling. The vulnerability arises when destroying the device, requiring mt76_dma_cleanup to run during module unload and ensuring pages are returned to the page po...

EUVD-2026-38936

In the Linux kernel, the following vulnerability has been resolved: drm/komeda: fix integer overflow in AFBC framebuffer size check The AFBC framebuffer size validation calculates the minimum required buffer size by adding the AFBC payload size to the framebuffer offset. This addition is performe...

CVE-2026-53042 fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use moduleinit, so cxlpcidriverinit runs first. When cxlpciprobe calls fwctlregister and then...

CVE-2026-53042

The CVE-2026-53042 issue affects the Linux kernel fwctl subsystem where class initialization ordering can trigger a NULL pointer dereference on device removal. Root cause: CXL is linked before fwctl in drivers/Makefile, leading to cxl_pci_driver_init() running before fwctl_init(). When cxl_pci_pr...

CVE-2026-53038

CVE-2026-53038 affects the Linux kernel IMA subsystem. When handling unsupported TPM hash algorithms, ima_fs can access hash_algo_name[] with an invalid crypto_id (set to HASH_ALGO__LAST), causing a read-out-of-bounds in create_securityfs_measurement_lists. The issue is associated with TPM_ALG_SH...

CVE-2026-53038 ima_fs: Correctly create securityfs files for unsupported hash algos

In the Linux kernel, the following vulnerability has been resolved: imafs: Correctly create securityfs files for unsupported hash algos imatpmchip-allocatedbanksi.cryptoid is initialized to HASHALGOLAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be...

CVE-2026-52936

A flaw was found in the Linux kernel's jitterentropy cryptographic module. A long-held spinlock during entropy collection could cause parallel readers to stall. This issue allows a local attacker to trigger a Denial of Service DoS by causing contention for the shared lock, making the system...

CVE-2026-52922

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking module. This vulnerability occurs because the batadvdatforwarddata function fails to validate the success of a memory allocation operation. An attacker could exploit this by triggering a scenario where t...

CVE-2026-52916

A flaw was found in the Linux kernel's batman-adv module. A remote attacker can exploit this vulnerability by sending specially crafted BATADVUNICASTFRAG packets, which are designed to contain other fragmented packets. This 'fragments in fragments' scenario causes the kernel to recursively proces...

CVE-2026-52920

A flaw was found in the Linux kernel's netfilter component, which is responsible for network packet filtering. This vulnerability, located in the xtpolicy module, involves an error in how strict inbound network policies are matched. This could allow an attacker to bypass established security rule...

CVE-2026-52915

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the ip6thbh module responsible for handling IPv6 Hop-by-Hop HBH options. This vulnerability allows a local attacker to provide an oversized list of HBH options from userspace, leading to an out-of-bounds write. This c...

Astra Linux – Vulnerability in grub2

A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory use-after-free issue, occurs because the normalexit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after...

Astra Linux – Vulnerability in Python 3.11

The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: tpm: Limit the number of PCR banks The function tpm2getpcrallocation does not impose any upper limit on the number of banks. The limit is set to eight banks, so values that exceed this limit from external I/O cause only limite...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2adc: Fixed a potential use-after-free in the sama5d2adc driver. The at91adcinterrupt function can call the at91adctouchdatahandler function to initiate the processing via schedulework&st-touchst.workq. If we...

Astra Linux – Vulnerability in Python 3.11

The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...

Astra Linux – Vulnerability in grub2

A vulnerability related to operations after freeing memory has been discovered in GRUB’s gettext module. This flaw arises from a programming error where the gettext command remains registered in memory even after its associated module is unloaded. An attacker can exploit this condition by invokin...

Astra Linux – Vulnerability in Node.js

A flaw in Node.js’s buffer allocation logic can expose uninitialized memory when allocations are interrupted, especially when using the vm module with the timeout option. Under certain timing conditions, buffers allocated using Buffer.alloc and other TypedArray instances like Uint8Array may conta...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove the improper idxdfree The call to idxdfree introduces a duplicate putdevice call, leading to a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15, PID: 4428, at...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fixed invalid PNP driver unregistration The Comedi low-level driver “c6xdigio” appears to be for a parallel port-connected device. When the Comedi core calls the driver’s Comedi “attach” handler c6xdigioattach t...