Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004008)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004008 advisory. A memory leak in the sofsetgetlargectrldata function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service memory...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003671 advisory. A memory leak in the sofdfsentrywrite function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service memory...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sofsdw: Prevent a jump to NULL for the addsidecar callback In the createsdwdailink function, it is checked that sofend-codecinfo-addsidecar is not NULL before calling it. The original code assumed that if...

CVE-2023-54233: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: avoid a NULL dereference with unsupported widgets If an IPC4 topology contains an unsupported widget, its .moduleinfo field won't be set, then sofipc4routesetup will cause a kernel Oops trying to dereference it. Add a...

Malicious code in kapvino-sof-fidaabi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642d1cd66002ad67c50bdc75a06e70cd2e163e4add1d4dd1f5b32fc84467be59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-sof-fidaobi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387be7dd9317b10c3aff2b7b9061ba36564408eb2af23f94d84cd6a59a9efb13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-sof-vaidas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6a8b05ea6db4286402ff926cc58ce8fc49e806da74d6e8a22709842e0516b96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-sof-vaids (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 993cd77bda3fed27d22b840d37fc7fe4d0a36a6dc8d99b3bee23673e850ae6fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-sof-vas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d22d0f08eee05b41c5123e15694885a807316cda4c4c6d5ef97665602ab3f261 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-140970

Malicious code in kapvino-sof-fidabi npm...

EUVD-2025-140971

Malicious code in kapvino-sof-fidaabi npm...

EUVD-2025-140969

Malicious code in kapvino-sof-fidaobi npm...

EUVD-2025-140968

Malicious code in kapvino-sof-fidbi npm...

EUVD-2025-140967

Malicious code in kapvino-sof-fidobi npm...

EUVD-2025-140966

Malicious code in kapvino-sof-vaidas npm...

EUVD-2025-140965

Malicious code in kapvino-sof-vaids npm...

EUVD-2025-140964

Malicious code in kapvino-sof-vais npm...

EUVD-2025-140963

Malicious code in kapvino-sof-vas npm...

MAL-2025-175301 Malicious code in kapvino-sof-vas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d22d0f08eee05b41c5123e15694885a807316cda4c4c6d5ef97665602ab3f261 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40132

CVE-2025-40132 (Linux kernel, ASoC Intel sof_sdw) : The issue arises in create_sdw_dailink() when calling add_sidecar callbacks on links that may contain codecs without an add_sidecar callback. The patch adds a NULL check for sof_end->codec_info->add_sidecar before invocation to prevent der...