CVE-2017-11176

CVE-2017-11176 Proof of concept for CVE-2017-11176 for code execution. Vulnerability The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial...

PT-2026-121992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci sock bind clears hci pisk-hdev and drops the device...

CLSA-2026-1777614769 kernel: Fix of 18 CVEs

crypto: algifaead - Fix minimum RX size check for decryption - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use...

CLSA-2024-1725876080 kernel: Fix of 45 CVEs

dmaengine: idxd: Fix possible Use-After-Free in irqprocessworklist CVE-2024-40956 - userfaultfd: fix a race between writeprotect and exitmmap CVE-2021-47461 - netfilter: nftables: use timestamp to check for set element timeout CVE-2024-27397 - x86/sev: Harden VC instruction emulation somewhat...

PT-2026-116862

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt min in sock ops A sockops prog reading skops-rtt min never checks the sk type: on the tcp conn request path sock ops-sk is a request sock non-full, and the ctx rewrite casts it to a tcp sock ful...

PT-2026-116680

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: validate event length before filtering is filtered packet reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command...

PT-2026-116679

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore subm...

PT-2026-116809

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf sock context code generation Currently, the ctx access code reads the rx queue mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, t...

Astra Linux – Vulnerability in Linux

A race condition in Linux kernel SCTP sockets net/sctp/socket.c before version 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If the sctpdestroysock function is called without using the socknetsk-sctp.addrwqlock lock, an element...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: tipc: Wait and exit until all work queues are completed On some hosts, a crash could occur simply by repeating these commands several times: bash modprobe tipc tipc bearer enable media udp name UDP1 localip 127.0.0.1 rmmod tipc T...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: BPF, sockmap: Do not allow sockmapclose,destroy,unhash to call itself. Proto callback functions in sockmap should never call themselves by design. Protect against bugs like 1 and break out of the recursive loop to avoid a stac...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: llc: Calling sockorphan at the release time syzbot reported an interesting trace 1 caused by a stale pointer to sk-skwq in a closed llc socket. In the commit ff7b11aa481f "net: socket: setting sock-sk to NULL after calling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed UAF in isosocktimeout The conn-sk might have been unlinked/freed while waiting for isoconnlock. Therefore, this check determines whether conn-sk is still valid by verifying that it is part of isosklist...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed a use-after-free in gtpencapdestroy. syzkaller reported a use-after-free in gtpencapdestroy. The same process freed “sk” and accessed it illegally. The commit e198987e7dd7 “gtp: fix suspicious RCU usage” added...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisock: Fixed an issue where user input was not validated. The length of user input was checked before copying data...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpfskassign The semantics for bpfskassign are as follows: sk = somelookupfunc bpfskassignskb, sk bpfskreleasesk That is, the sk is not consumed by bpfskassign. Therefore, the function must ensure...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: afunix: Fixed data races around sk-skshutdown. KCSAN identified a data race around sk-skshutdown wherein unixreleasesock and unixshutdown update it while unixstatelock is held; however, OTOH unixpoll and unixdgrampoll read it...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Network layer: Do not leave a dangling “sk” pointer when socket creation fails. It is possible to trigger a use-after-free by: - Attaching a “fentry” probe to sockrelease and the probe that calls bpfgetsocketcookie; - Running...

PT-2026-115193

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services unbound advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock queue timeout...

CVE-2026-98384

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...