Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath10k – Fix for the dmafreecoherent pointer dmaalloccoherent allocates a DMA-mapped buffer and stores the addresses in XXXunaligned fields. These addresses should be reused when freeing the buffer, rather than using the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: fixed TCP options overflow. Syzbot reported the following errors: Oops: general protection fault, likely due to a non-canonical address 0xdffffc0000000001: 0000 1 PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SCTP: The order of operations for SCTPCMDASSOCSHKEY should be changed to right after SCTPCMDPEERINIT. A null-ptr-deref issue was reported in the SCTP transmission path when the initialization of the SCTP-AUTH key fails:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: The issue of checking the received length in large packets has been fixed. Since commit 4959aebba8c0 “virtio-net: Use the MTU size as the buffer length for large packets”, when the guest gso is disabled, the allocated...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle actinetdevs allocation failure The kmallocarray in nfpfllagdowork will return null if physical memory runs out. Consequently, dereferencing actinetdevs results in null pointer dereferencing errors. This patch...

Astra Linux – Vulnerability in OpenLDAP

A flaw was discovered in OpenLDAP before version 2.4.57, which led to an invalid pointer issue and a crash in the slapd process during the saslAuthzTo processing step. This caused a denial-of-service attack...

Astra Linux – Vulnerability in SQLite3

The flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view. This can lead to a NULL pointer dereference or incorrect results...

Astra Linux – vulnerability in binutils

There is a flaw in binutils /bfd/pef.c. An attacker capable of submitting a specially crafted input file for processing by the objdump program could trigger a null pointer dereference. The primary risk posed by this flaw is application availability. It affects binutils versions prior to 2.34...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: mfd: ene-kb3930: Fix a potential NULL pointer dereference The offgpios may be NULL. Add a missing check in the kb3930probe function. This is similar to the issue fixed in commit b1ba8bcb2d1f "backlight: hx8357: Fix potential NULL...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: afpacket: avoid erroring out after sockinitdata in packetcreate After sockinitdata, the allocated sk object is attached to the provided sock object. On error, packetcreate frees the sk object, leaving the dangling pointer in the...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42completecopies On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location on the same NFS server. Accidentally,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fixed a UAF in blkcgunpinonline. blkcgunpinonline traverses the blkcg hierarchy to set the object as online. To traverse this hierarchy, it uses blkcgparentblkcg, but this call occurs after blkcgDestroyBlksblkcg, whic...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed a slab-use-after-free issue caused by a dangling pointer dqipriv. When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses the syscall to call ocfs2getnextid...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gpio: gr gpio: Add a NULL check in gr gpioprobe. The devmkasprintf function can return a NULL pointer in case of failure, but this returned value in gr gpioprobe is not checked. Add a NULL check in gr gpioprobe to handle the kern...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbdcryptmessage sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: i2c: dev: check return value when calling devsetname If devsetname fails, devname returns a null pointer; check the return value of devsetname to prevent a null-ptr-deref...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: media: dw2102: Fix null-ptr-deref in dw2102i2ctransfer In dw2102i2ctransfer, msg is controlled by user. When msgi.buf is null and msgi.len is zero, the aforementioned checks on msgi.buf would be performed. Malicious data then...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...

CVE-2026-100349

The kin-openapi Go project is vulnerable to a nil-pointer panic in the openapi3filter.ValidateResponse function in versions prior to 0.146.0 . The root cause occurs when an OpenAPI document declares a response header with content instead of a schema . Although the document passes initial validati...