PT-2026-106520

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the wifi wlcore component where the wlcore regdomain config function fails to release a runtime Power Management PM reference when the wlcore cmd regdomain config locked...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-198)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-198 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

PT-2026-106639

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xe shrinker walk function where it processes SYSTEM and TT LRUs without a runtime Power Management PM reference. When shrinking a buffer object bo outside of syste...

CVE-2026-98191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...

CVE-2026-98310: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

PT-2026-107167

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An uncontrolled recursion weakness exists in how the server builds and serializes geometry values produced by scripted runtime fields. While geometry supplied as text has a nesting-dept...

PT-2026-107223

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw exists where a regular expression used for a repository's external issue tracker containing alternating capture groups can produce invalid slice indexes during the rendering of issue...

CVE-2026-96399: Out-of-bounds Read

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

enterprise-integrated-channels (0.1.30), omnata-cli (>=0.1.3, <=0.2.0) +3 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.7.0)

snowflake-connector-python PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - enterprise-integrated-channels 0.1.30 - omnata-cli =0.1.3, =0.3.30, =2.0.0rc1, =2.1.2 Source cves:...

inthub-cli (>=0.1.4, <=0.1.26), omnata-plugin-devkit (>=0.5.3, <=0.11.0) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.12.0)

snowflake-connector-python PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - inthub-cli =0.1.4, =0.5.3, =0.5.0a112, =0.11.9 - snowflake-cli-labs 3.0.0rc0 Source cves: CVE-2026-86597...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mmc: rtsxpci: fixed the return value check in mmcaddhost The mmcaddhost function may return an error. If we ignore its return value, the memory allocated by mmcallochost will be leaked, leading to a kernel crash due to the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports “task hung in rpmresume” This issue is caused by aqc111suspend calling the PM variant of its writecmd routine. The simplified call trace looks like this:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare the clock during runtime suspend/resume If there is any clock controller attached to this I2C bus controller, such as Versaclock or an AIC32x4 I2C codec, then an I2C transfer triggered by th...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: q6afe-clocks: fixed the issue of reprobing of the driver. The q6afe-clocks driver may experience reprobing situations. For example, if the APR services are restarted after a firmware crash. However, currently, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Soundwire: Fixing enumeration completion The Soundwire subsystem uses two completion structures that allow drivers to wait for the Soundwire device to be enumerated on the bus and initialized by their respective drivers. The code...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fixed the refcount leak in armsmmudevice when armsmmurpmget fails. The armsmmurpmget function invokes pmruntimegetsync, which increases the refcount of “smmu”. This occurs even though the return value is less than...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in sndsocremovepcmruntime The function sndsocremovepcmruntime might be called with rtd == NULL, which will lead to a null pointer derefrence. This issue was reproduced when topology loading was...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/shtmu: Always leave the device running after a probe. The TMU device can be used both as a clocksource and as a clockevent provider. The driver attempts to manage its own power state and clock settings—turning...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: wwan: t7xx: The t7xxportenummsghandler function must now validate portcount against the message length in t7xxportenummsghandler. Additionally, a check for the size of portmsg must be added before accessing the port messa...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050-core: fix pmruntime error handling The return value of pmruntimegetsync is not checked, allowing the driver to access hardware that may fail to resume. The device usage count is also unconditionally incremented...