CLSA-2026-1792340315 TuxCare security update for @vue/compiler-sfc (1 CVE)

TuxCare rebuilt @vue/compiler-sfc to address 1 CVE. Fixed in 2.7.16-tuxcare.1...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sfc: fixed a kernel panic that occurred when creating VFs. When creating VFs, a kernel panic can occur when calling efxef10tryupdatenicstatsvf. When releasing a DMA coherent buffer, under certain circumstances, it is necessary to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sfc: Fixed an issue where a use-after-free occurred when disabling sriov. The use-after-free was detected by kfence when disabling sriov. What was read after it was freed was vf-pcidev: it was freed from pcidisablesriov, and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sfc: Fixed the TX channel offset when using legacy interrupts. In the legacy interrupt mode, the txchanneloffset was hardcoded to 1, but this is incorrect if efxsepparatetxChannels is set to false. In that case, the offset is 0...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: sfc: fixed the issue where all channels had TX queues. Normally, all channels have both RX and TX queues. However, this is not true when modparam efxseparatetxchannels=1 is used. In such cases, some channels only have RX queue...

Linux SPI Device Driver Heap Buffer Overflow DoS

The vulnerability of the amlsfcdmabuffersetup function in the drivers/spi/spi-amlogic-spifc-a4.c file of the Linux operating system’s SPI device driver is related to the occurrence of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...

Linux SPI Rockchip SFC Probe Heap Buffer Overflow

The vulnerability of the rockchipsfcprobe function in the drivers/spi/spi-rockchip-sfc.c driver for SPI devices in the Linux operating system is related to the repeated release of previously released memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net:sfc: Fixed issues with non-freezed interrupts in legacy IRQ mode. The SFC driver can be configured using modparam to work with MSI-X, MSI, or legacy IRQ interrupts. In the latter case, the interrupt wasn’t properly released...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: sfc: added re initialization of missing xdp queues When the size of the RX/TX ring buffer is changed, a kernel panic occurs when it acts as XDPTX or XDPREDIRECT. When the size of the TX/RX ring buffer is changed using...

Malicious Package

Overview vue-compiler-sfc-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100349 advisory. In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efxnetstats .ndogetstats64 can be called...

Malicious code in vue-compiler-sfc-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9 Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinstall hook runs...

MAL-2026-4707 Malicious code in vue-compiler-sfc-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9 Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinstall hook runs...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fixed DMA-API usage issues The use of the DMA-API function dmamapsingle was corrected to obtain the DMA address of the transfer buffer, instead of using virttophys for conversion. This fixes the following DMA-A...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - For the spi: amlogic: spifc-a4 component, there is a issue where the ECC engine is not registered properly upon probe failures, and the remove callback is not executed. - The amlsfcprobe function registers the on-host NAND E...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fixed a double-free in the remove callback. The driver uses devmspiregistercontroller for registration, which automatically unregisters the controller through devm cleanup when the device is removed. The manual...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - For the spi: amlogic: spifc-a4 issue, the error handling for DMA mapping has been fixed. Three bugs have also been fixed in the amlsfcdmabuffersetup function: 1. Unnecessary goto: When the first DMA mapping sfc-daddr fails,...

SUSE CVE-2026-43461

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic: spifc-a4: Fix DMA mapping error handling Fix three bugs in amlsfcdmabuffersetup error paths: 1. Unnecessary goto: When the first DMA mapping sfc-daddr fails, nothing needs cleanup. Use direct return instead of goto...

Linux Distros Unpatched Vulnerability : CVE-2026-43460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: rockchip-sfc: Fix double-free in remove callback The driver uses devmspiregistercontroller for registration, which automatically unregisters the controller...

CVE-2026-43460

A flaw was found in the Linux kernel's rockchip-sfc driver. This vulnerability occurs because the driver attempts to unregister a Serial Peripheral Interface SPI controller twice during device removal. This double-free operation can lead to memory corruption, which may allow a local attacker to...