Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Diesel allows to register custom aggregate SQL functions for SQLite via the SqliteAggregate interface. To store an instance of the custom aggregate processor Diesel relied on the sqlite3aggregatecontext function provided by sqlite. This function doesn't provide any guarantees about alignment of t...

EUVD-2026-27815

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpntcprecv, we receive large cloned skbs from strprcv that may contain multiple coalesced packets. The current implementation has two bugs: 1. Head...

EUVD-2026-27729

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length are both aligned to the block size should be classified as interlaced plain extents. Otherwise, it mu...

CVE-2026-43166 erofs: fix interlaced plain identification for encoded extents

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length are both aligned to the block size should be classified as interlaced plain extents. Otherwise, it mu...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mlxbf-bootctl: The sysfsemitat function was used in securebootfusestateshow. A warning is displayed when running the latest kernel on a BlueField SOC: 251.512704 ------------ Cut here ------------ 251.512711 Invalid sysfsemit:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath12k – Fix for the dmafreecoherent pointer. dmaalloccoherent allocates a DMA-mapped buffer and stores the addresses in XXXunaligned fields. These addresses should be reused when freeing the buffer, rather than using th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: kmsan: fixed an issue where out-of-bounds access to shadow memory occurred. Running sha224kunit on a KMSAN-enabled kernel results in a crash in kmsaninternalsetshadoworigin: BUG: Unable to handle a page fault for the address:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid kernel BUG for encrypted inode with unaligned file size The generic/397 test hits a BUGON for the case of encrypted inode with unaligned file size for example, 33K or 1K: 877.737811 run fstests generic/397 at 2025-01-...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - In blkdeviomapbegin, the EOF check has been refined. - In blkdeviomapbegin, the offset is rounded down to the logical block size before being stored in iomap-offset. It is also checked that the size remains within the inode...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Block: Fixed page ref counts for unaligned buffers in bioreleasepages. Fixed the issue where an incorrect number of pages were released for buffers that do not start at the beginning of a page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv/purgatory – align riscvkernelentry. When alignment handling is delegated to the kernel, everything must be word-aligned in purgatory, since the trap handler is then set to the kexec one. Without proper alignment, encounteri...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: does not allow unaligned truncation on released compress inode An F2FS image may become corrupted after performing the following test cases: - mkfs.f2fs -O extraattr,compression -f /dev/vdb - mount /dev/vdb...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: spi: nxp-fspi: fixed the KASAN out-of-bounds bug The length of the memcpy operation was changed to address the out-of-bounds issue when writing data that is not 4-byte aligned to the TX FIFO. To reproduce the issue, 3 bytes of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wireguard: allowedips – avoid unaligned 64-bit memory accesses On the Parisc platform, the kernel issues warnings because swapendian attempts to load a 128-bit IPv6 address from an unaligned memory location: - Kernel: Unaligned...

RUSTSEC-2026-0131 Double-free in `Chomp::inner()`

Chomp::inner uses std::ptr::readunaligned to move out the value from a raw pointer. If the original value is an owned type e.g. Box, calling inner moves out the ownership, but the original variable will still be dropped at the end of its scope. This causes the same heap memory to be freed twice,...

Double-free in `Chomp::inner()`

Chomp::inner uses std::ptr::readunaligned to move out the value from a raw pointer. If the original value is an owned type e.g. Box, calling inner moves out the ownership, but the original variable will still be dropped at the end of its scope. This causes the same heap memory to be freed twice,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unaligned DMA cache for long HMAC key memory allocations in the caam driver, which could lead to hash key...

Possible unaligned data access for implementations of `SqliteAggregate`

Diesel allows to register custom aggregate SQL functions for SQLite via the SqliteAggregate interface. To store an instance of the custom aggregate processor Diesel relied on the sqlite3aggregatecontext function provided by sqlite. This function doesn't provide any guarantees about alignment of t...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013499)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013499 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: extable: fix loadunalignedzeropad reg indices In exhandlerloadunalignedzeropad we...

Unity Linux 20.1050a / 20.1060a Security Update: kernel (UTSA-2026-013389)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013389 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix scsimodesense buffer length handling Several problems exist with scsimodesense...