Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The commit bc235cdb423a “bpf: Prevent deadlock from recursive bpftaskstorageget|delete” first introduced deadlock prevention for fentry/fexit programs attaching to bpftaskstorage...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ppp: Fixed the “KMSAN: uninit-value” warning with bpf. Syzbot detected a “KMSAN: uninit-value” warning 1. This issue arises because the ppp driver does not initialize a 2-byte header when using socket filter. The following code c...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: A “off-by-one” error occurred in buildprologue. Vincent reported that running BPF programs with tail calls on LoongArch causes a kernel hard lockup. Debugging these issues revealed that the JIT-compiled code misse...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the rxsk parameter was added to the tracekfreeskb argument array. However, rxsk is optional and can be NULL. Yan Zhai reported that a BPF program could trigger a NULL pointer derefrence if the program did no...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: do not allow a packet limit of 1 The current implementation does not work correctly with a limit of 1 packet. iproute2 actually checks for this, and this patch adds this check as well in the kernel. This fix...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fixed the issue caused by invalid use of countedby GCC 15 recognizes the countedbylen attribute in vsctppacket.buf, and the vsc-tp.c code uses this attribute incorrectly. len does not contain the available size in the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: mctp i3c: handling of NULL header addresses daddr can be NULL if there is no neighbour table entry present; in that case, the TX packet should be discarded. saddr is usually set by the MCTP core, but NULL values are also...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed the memory leak in bpfskselectreuseport As pointed out in the original comment, a lookup in sockmap can return a TCP ESTABLISHED socket. Such a TCP socket may have had SOATTACHREUSEPORTEBPF set before it became...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Added BHB mitigation to the epilogue for cBPF programs. A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. Upon exiting a cBPF program, the BHB...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Check the changespktdata property for extension programs. When processing calls to global sub-programs, the verifier decides whether to invalidate all packet pointers in the current state, depending on the changespktdata...

TencentOS Server 2: bind (TSSA-2023:0246)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0246 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

TencentOS Server 3: samba (TSSA-2023:0202)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0202 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-4227

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows...

Security update for the Linux Kernel (Live Patch 7 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002333 fixes several issues. The following security issues were fixed: CVE-2025-21680: pktgen: Avoid out-of-bounds access in getimixentries bsc1236701. CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmtremoveadvmonitorsync bsc1239096...

SUSE-SU-2025:01944-1 Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002330 fixes several issues. The following security issues were fixed: - CVE-2025-21680: pktgen: Avoid out-of-bounds access in getimixentries bsc1236701. - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmtremoveadvmonitorsync...

CVE-2025-4227

CVE-2025-4227 affects Palo Alto Networks GlobalProtect App (Windows and macOS). The Endpoint Traffic Policy Enforcement feature is vulnerable to improper access control, allowing certain packets to remain unencrypted within the tunnel. A physical-access attacker could inject rogue devices to inte...

CVE-2025-4227 GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows...

CVE-2025-4227 GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows...

Security update for the Linux Kernel (Live Patch 4 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002322 fixes several issues. The following security issues were fixed: CVE-2024-49855: nbd: fix race between timeout and normal completion bsc1232900. CVE-2025-21680: pktgen: Avoid out-of-bounds access in getimixentries bsc1236701. CVE-2024-58013:...