Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/mprotect: Only reference swappfn is called if the type matches. Yu Zhao reported a bug after the commit “mm/swap: Add swpoffsetpfn to fetch PFN from swap entries” added a check in swpoffsetpfn for the swap type 1: Kernel bug a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mm/shmem, swap: fixed the soft lockup issue with mTHP swapin. The following soft lockup can be easily reproduced on my test machine using the following command: echo always...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mm: cachestat: fixed two shmem bugs When cachestat on shmem overlaps with swapping and invalidation, there are two possible bugs: 1 A swapin error may result in a corrupted swap entry in the shmem inode’s xarray. Calling...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fixed a potential UAF issue related to VMA readahead. Since commit 78524b05f1a3 “mm, swap: avoiding redundant swap device pinning”, the common helper function for allocating and preparing a swap entry in the swap cache...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: Do not clobber swpentryt during THP split. The following issue was observed when running stress mmap since the commit b653db77350c: “mm: Clear page-private when splitting or migrating a page.” Watchdog: BUG: Soft...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021574)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021574 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition...

kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARNON due to a commitoverrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer...

GHSA-VP62-88P7-QQF5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Summary A race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This advisory covers the race during mountpoint creation. The related race during the subsequent mount syscall is tracked in...

CLSA-2026-1779122764 nano: Fix of CVE-2024-5742

CVE-2024-5742: emergencysave applied chmod/chown to a path after the descriptor was closed, allowing a symlink swap to redirect the ownership change to an attacker-controlled file - Backport of upstream commit 5e7a3c2e from nano v8.0, adapted to the 5.6.1 codebase writefile signature predates the...

Linux Distros Unpatched Vulnerability : CVE-2026-43909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SwapRGBABytes process. An attacker can trigger out-of-bounds memory access by supplying a specially crafted kABGR DPX image with large dimensions, leading to potential reading from or writing to unintended...

Malicious code in chai-as-regulated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f7f8d21f5d33db136b1e10fc7fbb6d2a1540240911b0630e7fc9f8724c7b26 Package is published as chai-as-regulated, a name mimicking the widely-used chai-as-promised Chai plugin, and the README instructs users to register ...

EUVD-2026-30415

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i 4 inside SwapRGBABytes causes the function to compute a large negative...

CVE-2026-43909 OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i 4 inside SwapRGBABytes causes the function to compute a large negative...

CVE-2025-62625

CVE-2025-62625 concerns improper privilege management in the KVM key download component, enabling token swapping to obtain sensitive keys and potentially access privileged resources. The NVD/CVE records describe impact to confidentiality with CVSS v4.0 base metrics: Attack Vector NETWORK, Attack ...

CVE-2025-62625

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

PT-2026-41028

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.18.0 OpenImageIO versions prior to 3.1.13.0 Description A signed 32-bit integer overflow occurs in the loop index expression i 4 within the SwapRGBABytes function when processing kABGR DPX images with large...

SUSE CVE-2026-43303

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: clear page-private in freepagesprepare Several subsystems slub, shmem, ttm, etc. use page-private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via...

SUSE CVE-2025-38241

In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix softlockup with mTHP swapin Following softlockup can be easily reproduced on my test machine with: echo always /sys/kernel/mm/transparenthugepage/hugepages-64kB/enabled swapon /dev/zram0 zram0 is a 48G swap...

CVE-2026-43303

A flaw was found in the Linux kernel's memory management subsystem. When pages are freed, the page-private field is not properly cleared. If these pages are later reallocated as high-order pages and split, the tail pages can retain stale page-private values. This can lead to a use-after-free...