Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: liveupdate: Fixed issues in luofileunpreservefiles and luofilefinish. In luofileunpreservefiles and luofilefinish, the calls to moduleput and xaerase were reordered to ensure that the file handling module remains pinned while...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - scsi:mpi3mr: Fixed a potential deadlock in mpi3mrfaultueventemit. mpi3mrfaultueventemit is executed from the fault watchdog and reset paths, where host I/O might already be blocked. Allocation operations using GFPKERNEL both...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, for the dsa interface, in the mxl862xx module, there was a issue where the DSA ports were freed after they had been used. Upon a MDIO CRC error, the mxl862xxcrcerrworkfn function iterates through the DSA por...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: alloctag: Fixed a use-after-free in /proc/allocinfo after module unloading. The allocinfostart function only reinitializes the codetag iterator at position 0. For subsequent reads positions 0, it reuses the cached iterator state...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: rxrpc: Fixed a potential infinite loop in rxrpcrecvmsg. Also, fixed the wait in rxrpcrecvmsg by checking the OOB queue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net: phy: sfp section, there was a issue where the sfpi2cmdiobusdestroy function failed to properly free the bus. The sfpi2cmdiobuscreate function allocates the I2C MDIO bus using mdioi2calloc, a straightforward allocation...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF Use-After-Free issue caused by a race between btftrygetmodule and loadmodule. While working on code to populate the BTF IDs for modules during their initialization, I noticed that by the time the initialization...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net:sfc: Fixed issues with non-freezed interrupts in legacy IRQ mode. The SFC driver can be configured using modparam to work with MSI-X, MSI, or legacy IRQ interrupts. In the latter case, the interrupt wasn’t properly released...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to prevent race conditions during the fsyncentryslab access by multiple f2fs filesystem instances. As reported by syzbot, there is a use-after-free issue during f2fs recovery: A use-after-free occurs when...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed an issue where credits were not updated upon failure in cifsissueread. Fixed an issue where the credits value was not updated during a failed execution of cifsissueread, so that retrying the subreq would not...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: Freeing volume-wide resources upon a fillsuper failure The erroutnow path in ntfsfillsuper only frees the volume struct via kfreevol. Several resources owned by the volume are left behind upon each mount failure: -...

Malicious Package

Overview digitalexp-style-module-l9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview devplatform-spa-plugin-s3-module-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

CVE-2026-53784

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

CVE-2026-78541: Improper Neutralization of Special Elements used in an OS Command

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

python-urwid security update

2.1.2-4.1 - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module - Resolves: RHEL-212564...

PT-2026-81021

Name of the Vulnerable Software and Affected Versions Rocq Prover affected versions not specified Description The software fails to restore the universe graph's copy of the universe checking flag after a module that locally disabled the check is closed. While the global flag is restored, the...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-81016

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

PT-2026-80993

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...