EUVD-2026-66491

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098962)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098962 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irqwork can be queued in...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098957)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098957 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnethdr in tpacketsnd In tpacketsnd, when PACKETVNETHDR is...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098712)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098712 advisory. In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in icesetringparam In icesetringparam, txrings and xdprings are allocated...

CVE-2026-74601

A flaw was found in the Linux kernel's ring-buffer component. A race condition exists within the ringbufferswapcpu function, where a committing counter can temporarily drop to zero during a write operation. This allows a buffer swap to occur while a write is still in progress, resulting in an...

CVE-2026-74697

A flaw was found in the Linux kernel's bnxten driver. This vulnerability occurs when End of frame padding EOP on the AGG ring overlaps with subsequent data segments. On older network chips, if Relaxed Ordering RO is active, this overlap can cause valid data to be overwritten with zeros. This can...

CVE-2026-13212

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

EUVD-2026-64925

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212

The Zephyr RTOS virtio driver contains an out-of-bounds read in virtio_isr() (drivers/virtio/virtio_common.c). The device-written descriptor-chain head id from the used ring is used directly as an index into recv_cbs[] and desc[] without a bounds check. A malicious or compromised virtio backend (...

CVE-2026-74634

A flaw was found in the Linux kernel's ring-buffer component. This vulnerability occurs when the system attempts to change the order of sub-buffers while resizing is disabled, leading to memory being freed prematurely. A local attacker could exploit this use-after-free condition to potentially...

CVE-2026-74610

A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...

CVE-2026-74602

A flaw was found in the Linux kernel's ring-buffer component. The rballocatecpubuffer function failed to initialize the bpage-order value, leaving it as zero. This uninitialized value is later used by freebufferpage when deallocating ring-buffers with sub-buffers larger than a page size. An...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed DMA mapping leaks During the reallocation of RX buffers, new DMA mappings are created for those buffers. Reproduction steps: While doing the following: Do For i=0; i=8160; i=i+32 Do ethtool -G enp130s0f0 rx $i tx $...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: xHCI: Corruption of the command ring pointer occurred during command aborts. The command ring pointer is located at bits 6:63 of the command ring control register CRCR. All control bits, such as those related to command stopping...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aqringhwtsrxalloc maps extra AQCFGRXDSDEF bytes for PTP HWTS ring but then generic aqringfree does not take this into account. Create and use a specific function to free...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: rxrpc: Fixed the issue where the listen function sets the backlog to too high for preallocation rings. The listen handler of AFRXRPC allows you to set the backlog to 32 if you increase the sysctl value. However, although the...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Ring-Buffer: Sync-IRQ works before the buffer is destroyed. If something was written to the buffer just before its destruction, it may be possible—though not in a real system—to destroy the ringbuffer before the IRQ-related...