CVE-2026-68188

CVE-2026-68188 : In the Linux kernel Bluetooth RFCOMM path, a race caused use-after-free in rfcomm_send_rpn when rfcomm_tty_set_termios tests dlc->session without holding rfcomm_mutex and the DLC/session is freed by krfcommd. The fix adds rfcomm_dlc_send_rpn() that holds rfcomm_mutex while ver...

EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

EUVD-2026-55551

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68165

The CVE affects the Linux kernel DAMON subsystem (mm/damon/core) where damon_set_regions() did not validate zero-length regions created by certain callers (DAMON_SYSFS, DAMON_RECLAIM, DAMON_LRU_SORT). This could trigger WARN_ONCE on CONFIG_DAMON_DEBUG_SANITY and cause a divide-by-zero in damon_me...

EUVD-2026-55550

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68164

The CVE concerns the Linux kernel DAMON subsystem, specifically the function damon_set_regions() in mm/damon/core. The root cause was that input ranges were assumed to be sorted and non-overlapping, but a prior commit removed validation, allowing overlapping ranges. The consequence can be odd mon...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

EUVD-2026-55529

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145

CVE-2026-68145 describes a Linux kernel iomap vulnerability where zero-length ranges in ifs_set_range_dirty() and ifs_set_range_uptodate() cause an unsigned underflow in (off + len - 1) >> i_blkbits, producing a huge last_blk and nr_blks and leading to out-of-bounds bitmap_set() writes. A f...

EUVD-2026-55481

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a memory leak in setsspcomplete. The memory leak was fixed in setsspcomplete, where the mgmtpendingcmd structures are not freed after they are removed from the pending list. Commit 302a1f674c00 “Bluetoot...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking The catcprobe function fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors. This occurs as follows: - usbsndbulkpipeusbdev, 1 and...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: romfs: Check the return value of sbsetblocksize. The romfsfillsuper function ignores the return value of sbsetblocksize, which may fail if the requested block size is incompatible with the block device’s configuration. This issue...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Unconditionally sets set-nelems before inserting an element. In the event that the set is full, a new element is inserted and then removed without waiting for the RCU grace period. Meanwhile, the RCU reader m...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftsetpipapo: clamp the maximum map bucket size to INTMAX Otherwise, a WARNONONCE error may occur in kvmallocnodenoprof when resizing the hashtable, because GFPNOWARN is not set. Similar issues include: b541ba7d1f5a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: Fixed a memory leak that occurred due to a failure in usbsubmiturb. In asyncsetregisters, when usbsubmiturb fails, the allocated asyncreq structure and URB are not freed, resulting in a memory leak. The...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Platform/x86: dell-wmi-sysman: Do not perform hex dumping of plaintext password data. The setnewpassword function performs hex dumping of the entire buffer, which contains plaintext password data, including current and new...