Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001246)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001246 advisory. A double-free can happen in idrremoveall in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or...

SUSE-SU-2026:20244-1 Security update for elemental-toolkit, elemental-operator

This update for elemental-toolkit, elemental-operator fixes the following issues: elemental-operator: - Update to version 1.6.10: Remove 'latest' tag as this overlaps with the latest branch Bump github.com/rancher-sandbox/go-tpm and its dependencies This bump includes fixes to some CVEs: bsc12418...

SUSE CVE-2025-68804

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread crosecconsolelogwork is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001995)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001995 advisory. The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attribute...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002582)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002582 advisory. An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in removedirtysegment in fs/f2fs/segment.c when mounting an f2fs image...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002350)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002350 advisory. mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001851 advisory. Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002260 advisory. Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free...

kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3removerequests concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a...

AZL-74400 CVE-2025-71075 affecting package kernel for versions less than 6.6.121.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asdpciremove function fails to synchronize with pending tasklets before freeing the asdha structure, leading to a potential use-after-free vulnerability. When a device...

CVE-2025-69990

phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in removefile.php. The parameter file can cause any file to be deleted...

CVE-2025-69990

phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in removefile.php. The parameter file can cause any file to be deleted...

UBUNTU-CVE-2025-68804

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread crosecconsolelogwork is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device ...

CVE-2025-68804

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread crosecconsolelogwork is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device ...

CVE-2025-68804

CVE-2025-68804 relates to the Linux kernel component platform/chrome: cros_ec_ishtp, where a UAF occurs after a driver is unbound because the EC device isn’t unregistered in the driver’s .remove(), leaving a kthread (cros_ec_console_log_work) that may access the device. Effect: crash due to use-a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fixed a crash that occurred during the transportportremove function, by using iocinfo. During this function, messages were logged via devprintk regarding &mpt3sasport-port-dev. At this point, the SAS transport devi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid removing buffers when legacy fileio is active The vb2ioctlremovebufs call manipulates the internal buffer list of the queue. This may potentially overwrite pointers used by the legacy fileio interface...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this by using the cifssgsetbuf helper function, which converts vmalloc’d...

MAL-2026-245 Malicious code in cnamts-captcha-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f061900c13c9363e97f1336b62c6c9efff79aefdae954a4d6183900bf71f69c The package cnamts-captcha-component was found to contain malicious code. Source: ghsa-malware...

MAL-2026-244 Malicious code in helium-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 643f63c743fd06fb24cb2d488e001ce0efab3f0d82014801ea2eebad96041692 The package helium-module was found to contain malicious code. Source: ghsa-malware d34558c0d1e56c0103ad087e485e142f3918050a1b0bdc15fc7e7b46c1a2ae1f...