CVE-2026-89855: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...

PT-2026-93544

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.3 and later Description An issue exists in the LoongArch architecture where the rethook trampoline incorrectly saves and restores the $r21 $u0 register, which serves as the percpu base. When rethook trampoline handler...

CVE-2026-89903: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

Linux Distros Unpatched Vulnerability : CVE-2026-89903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and...

Linux Distros Unpatched Vulnerability : CVE-2026-89905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter...

CVE-2026-91995

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

EUVD-2026-78435

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

CVE-2026-91995 pig before 4.1.0 Unverified Password Change via /register/password

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

CVE-2026-91995

pig before 4.1.0 contains an authentication bypass in the /register/password endpoint where password verification results are discarded, effectively allowing any value to be accepted as the current password. A remote, unauthenticated attacker can submit a known username with an incorrect current ...

CVE-2026-91995 pig before 4.1.0 Unverified Password Change via /register/password

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

CVE-2026-91995 pig before 4.1.0 Unverified Password Change via /register/password

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

PT-2026-91935

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0 Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password...

CVE-2026-91995: Unverified Password Change

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock. A deadlock may occur because i3cmasterregister acquires &i3cbus-lock twice. See the log below. Use i3cdev-desc-info instead of calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mcb: fixed a double-free bug in chameleonparsegdd. In chameleonparsegdd, if mcbdeviceregister fails, ‘mdev’ will be released through putdevice in mcbdeviceregister. As a result, the statement “goto ‘err’ label” and the subsequent...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATEBVi in the guest XSAVE state whenever XFDi=1 When loading the guest XSAVE state via KVMSETXSAVE, and when updating XFD in response to a guest WRMSR, the disabled features in XSTATEBV are cleared to ensure tha...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fixed the potential error pointer dereferencing in the probe function. The drv-sramreg pointer could potentially be set to ERRPTR-EPROBEDEFER, which would lead to an error pointer dereferencing. Use...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: edia: dvbdev: fixed a use-after-free issue. In dvbregisterdevice, pdvbdev is set to equal dvbdev, which is freed in several error-handling paths. However, pdvbdev is not set to NULL after dvbdev’s deallocation, resulting i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fixed the incorrect register used in suspend/resume operations. The “enable” register should be BERLINPWMEN instead of BERLINPWMENABLE. Otherwise, the driver will access the wrong address, leading to a CPU exception...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: DM integrity: Error in the call to kmemcachedestroy in dmintegrityinit. Otherwise, the journaliocache will be leaked if dmregistertarget fails...