Shizuka

Shizuka Bluetooth extensions with shared Android settings/status tools and explicit, verified native device backends. Codec selection, sample rate, bit depth, preferred transport and device permissions follow Android's Bluetooth state. The module no longer replays a private 48 kHz/HQ preference...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ queues, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields such as nums...

CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the HTTP/2 h2 receive path fails to enforce endpoint restrictions such as SETTINGSMAXCONCURRENTSTREAMS and SETTINGSMAXHEADERLISTSIZE. As a result, write limits on control frames are bypasse...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mctp: i2c: fix skb memory leak in receive path When ‘midev-allowrx’ is false, the newly allocated skb is not consumed by netifrx; it must be freed directly...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: can: afcan: fix NULL pointer dereference in canrcvfilter Following the commit 8aa59e355949 “can: afcan: fix NULL pointer dereference in canrxregister”, we must verify that mlpriv is properly initialized in the receive path of CAN...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: inet: Sk-skrxdst was converted to RCU rules. The syzbot reported various issues related to early demux processing. One of these issues is included in this changelog 1. Sk-skrxdst uses RCU protection without proper documentatio...

CVE-2026-107166

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

EUVD-2026-94412

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166

The Open5GS software (versions up to 2.7.7 ) is vulnerable to a remote attack affecting the GTP-U Receive Path component. The flaw exists in the ogs_pfcp_xact_local_create function within the src/upf/gtp-path.c file, where a manipulation can lead to an allocation of resources (CWE-770, CWE-400). ...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107166: Allocation of Resources Without Limits or Throttling

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

PT-2026-107570

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs pfcp xact local create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the QUIC receive path, which holds a reference to the packet buffer until the application reads the stream data out of it. An attacker can hold that memory allocated for as long as...

Linux Distros Unpatched Vulnerability : CVE-2026-87799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...

CVE-2026-87799

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

UBUNTU-CVE-2026-87799

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...