CVE-2025-29646

An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and teid = 0 or teid = ogspfcppdrteidpool.size...

PT-2025-25898 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the XDP SHARED UMEM mode in the Linux kernel, where packets are corrupted for the second and any further sockets bound to the same umem. This does not affect th...

PT-2025-25962 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically in the drm/sun4i: dsi component. The issue occurs when computing packet sizes, where the packet overhead is subtract...

CVE-2025-29646

The CVE-2025-29646 entry concerns Open5GS (UPF) with versions 2.7.2 and earlier. The vulnerability allows a remote attacker to cause a Denial of Service by sending a crafted PFCP SessionEstablishmentRequest packet where restoration_indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_p...

PT-2025-25901

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been identified in the Linux kernel where the bpf prog test run skb function runs a bpf program that redirects empty skbs, causing the fq codel drop function to attem...

CLSA-2025-1750176020 kernel: Fix of 6 CVEs

pfifotailenqueue: Drop new packet when sch-limit == 0 CVE-2025-21702 - xfs: add bounds checking to xlogrecoverprocessdata CVE-2024-41014 - netfilter: validate user input for expected length CVE-2024-35896 - nfs: fix UAF in direct writes CVE-2024-26958 - Squashfs: check the inode number is not the...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching bsc1242006. CVE-2024-35840: mptcp: use OPTIONMPTCPMPJSYNACK in subflowfinishconnect bsc122459...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Mitigation is only applied to cBPF programs loaded by unprivileged users. Support for eBPF programs loaded by unprivileged users is typically disabled. This means that only cBPF programs need to be mitigated for BHB...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: BPF: Fixed an array bounds error with maygoto. Maygoto uses an additional 8 bytes on the stack, causing the interpreters array to go out of bounds when calculating the index using stacksize. 1. If a BPF program is rewritten,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Do not override the return value of subprog The verifier test "calls: div by 0 in subprog" triggers a panic at the ld.bu instruction. The ld.bu instruction attempts to load a byte from the memory address returned ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in various contexts. When a program running in a non-preemptible context uses the bpfsendsignal function, issues may arise because this function can enter ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Tracking the changespktdata property for global functions When processing calls to certain helpers, the verifier invalidates all packet pointers in the current state. For example, consider the following program: c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Discard packets if the transport changes. If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when accessing...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: copyverifierstate should copy the ‘loopentry’ field. The bpfverifierstate.loopentry state should be copied by copyverifierstate. Otherwise, values of .loopentry from unrelated states could corrupt env-curstate. Additionally,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: delete intermediate secpath entry in packet offload mode Packets handled by hardware have added secpath as a way to inform XFRM core code that this path was already handled. That secpath is not needed at all after policy is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: bounds checks were added to the host bulk flow fairness counts. Although we fixed a logic error in the commit cited below, the syzbot still managed to cause an underflow in the per-host bulk flow counters, resulti...

Astra Linux - Vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3processxdp The vmxnet3 driver’s XDP handling is buggy for packet sizes using ring0 that is, packet sizes between 128 and 3k bytes. We observed MTU-related connectivity issues with...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: A “off-by-one” error occurred in buildprologue. Vincent reported that running BPF programs with tail calls on LoongArch causes a kernel hard lockup. Debugging these issues revealed that the JIT-compiled code misse...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the rxsk parameter was added to the tracekfreeskb argument array. However, rxsk is optional and can be NULL. Yan Zhai reported that a BPF program could trigger a NULL pointer derefrence if the program did no...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fixed the issue caused by invalid use of countedby GCC 15 recognizes the countedbylen attribute in vsctppacket.buf, and the vsc-tp.c code uses this attribute incorrectly. len does not contain the available size in the...