Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: core: Fixed a use-after-free in sndsocexit. KASAN reported a use-after-free: BUG: KASAN: Use-after-free in devicedel+0xb5b/0xc60. A read of size 8 at address ffff888008655050 was performed by the task rmmod/387. CPU: 2;...

PT-2026-85707

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi novation output snd usbmidi novation output lays out a two-byte header at transfer buffer0..1 and passes &transfer buffer2 together with a length of ep-max transfer - 2 to snd rawmidi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A race condition was detected in the Linux kernel’s sound/hda device driver, specifically in the sndhdacregmapsync function. This can lead to a null pointer dereferencing issue, potentially causing a kernel panic or a denial-of-service attack...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: fixed a possible null-pointer dereference due to a data race in sndhdacregmapsync The variable codec-regmap is often protected by the lock codec-regmaplock when it is accessed. However, it is accessed without holding t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: Ensure that snduna is properly initialized upon connection. This issue is strictly related to the commit fb7a0d334894 “mptcp: Ensure that sndnxt is properly initialized upon connection”. It turns out that syzkaller can...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Fixed error handling in sndprotoprobe. The devicenode pointer is returned by ofparsephandle, with the refcount incremented. We should use ofnodeput on it after that operation. This function only calls ofnodeput in th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq – Use sndcardfreewhenclosed when there is a USB disconnection. The callback for USB disconnection should be short and not too long. Alternatively, the current code uses sndcardfree when there is a disconnection, but...

The vulnerability of the `virtio_snd_pcm_in_cb` function in the `hw/audio/virtio-snd.c` component of the QEMU hardware emulation software allows a hacker to trigger a service failure.

The vulnerability of the virtiosndpcmincb function in the hw/audio/virtio-snd.c component of the QEMU hardware emulation software is related to the issue of writing operations outside of the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability in the hw/audio/virtio-snd.c component of the QEMU hardware emulation software allows a hacker to trigger a system failure.

The vulnerability of the hw/audio/virtio-snd.c component of the QEMU hardware emulation software is related to integer overflow. Exploiting this vulnerability can allow an attacker to cause a system failure...

SUSE CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74503 ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74503

In the provided CVE-2026-74503 entries, the Linux kernel ALSA timer issue is resolved: snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and a close can leave an object referenced if reopened mid‑process. The vulnerability concerns ALSA timer handling when closing snd_timer in...

EUVD-2026-55302

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-64479

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA sequencer. This vulnerability allows an unprivileged local user to trigger a heap information leak in the sndseqeventdup function. By reading from /dev/snd/seq, an attacker can obtain 4 bytes of uninitialized kernel hea...

CVE-2026-64490

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index gv2atypemap in...

CVE-2026-64482

In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndgf1pcmvolumecontrol does not check the return value before dereferencing kctl-id.index, which can lead to a NULL pointer...

EUVD-2026-48823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...

Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.34 fixes various security issues The following security issues were fixed: CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...

SUSE-SU-2026:2945-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.34 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...

Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.31 fixes various security issues The following security issues were fixed: CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...