Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: properly canceled the timer from tapriodestroy There is a comment in qdisccreate regarding the fact that we do not call ops-reset in some cases. errout4: “Any broken qdiscs that would require an ops-reset...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check the scheduler’s work queue before calling timeout handling. During an IGT GPU reset test, we still encounter an oops despite the commit 0c8c901aaaebc9 drm/sched: Check the scheduler’s readiness before calling...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Avoid data corruption. Wait for all dependencies of a task to complete before terminating it, to prevent data corruption...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iavf: Remove the “crit lock” mechanism. This removal frees us from the error-prone logic associated with trylocks. Thanks to netdevlock by Jakub, this has become easier to implement. In most cases, we were already protected by th...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: schtaprio: fixed possible use-after-free issue. syzbot reported a serious crash 1 in nettxaction, which made no sense until we obtained a reproducible example. This example reinstalls the taprio qdisc, but an invali...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: net:sched: fixed a possible refcount leak in tcnewtfilter. It is necessary to call tfilterput to store the refcount obtained from tp-ops-get, to avoid possible refcount leaks when chain-tmpltops != NULL and chain-tmpltops !=...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fixed the transmit scheduler resource leak. To support shaping and scheduling, upon class creation, the Netdev driver allocates transmit schedulers. The previous patch that added support for Round Robin scheduling...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sched/ext: Prevent calls to updatelockedrq with a NULL rq. Avoid invoking updatelockedrq when the runqueue .rq pointer is NULL in the SCXCALLOP and SCXCALLOPRET macros. Previously, calling updatelockedrqNULL with preemption enabl...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fixed an oops due to incorrect drmsched init/fini calls. Currently, amdgpu calls drmschedfini from the fence driver’s fini routine. Such a call is expected to occur only after the respective init function,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A use-after-free vulnerability in the Linux kernel’s net/sched:clsRoute component can be exploited to achieve local privilege escalation. When the route4change function is called on an existing filter, the entire tcfresult struct is always copied into the new instance of the filter. This creates ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021611 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using...

CLSA-2026-1779215980 cups: Fix of CVE-2026-27447

CVE-2026-27447: fix authorization bypass via case-insensitive username comparison in scheduler...

CLSA-2026-1779215547 cups: Fix of CVE-2026-27447

CVE-2026-27447: fix authorization bypass via case-insensitive username comparison in scheduler...

GHSA-JR8M-X4P7-P3V5 TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrati...

CVE-2026-8727

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative...

CVE-2026-8727 Remote Code Execution in extension "Site Crawler" (crawler)

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative...

CVE-2026-8727

The CVE-2026-8727 affects the TYPO3 Crawler extension (Site Crawler). The root cause is that the Crawler extension forwards the X-T3Crawler-Meta response header directly to PHP’s unserialize(), allowing an attacker-controlled crawled endpoint to inject arbitrary serialized PHP objects, leading to...

CVE-2026-8727 Remote Code Execution in extension "Site Crawler" (crawler)

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative...

CVE-2026-8727

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative...

CVE-2026-8727 Remote Code Execution in extension "Site Crawler" (crawler)

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative...