CVE-2026-24401 vulnerabilities

Vulnerabilities for packages: avahi...

CVE-2026-72479

A flaw was found in the Linux kernel's iio: accel: mma8452 module. When an I2C read operation fails, the mma8452read function incorrectly returns a success status. This can lead to the mma8452readraw function using uninitialized stack memory, potentially resulting in information disclosure...

CVE-2026-72453

A flaw was found in the Linux kernel's regcache mechanism. During initialization, an error in a specific callback function cacheops-populate can have its error code overwritten by a subsequent exit routine. This masks the original error, potentially causing the system to attempt operations on...

CVE-2026-72447

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostic SCTPDIAG endpoint dumping mechanism. A race condition occurs when address lists are traversed without holding the necessary socket lock, allowing concurrent modifications. A local attacker could exploit th...

CVE-2026-72444

A flaw was found in the Linux kernel's flowdissector component. When processing network packets on non-Ethernet devices, such as a TUN device in L3 mode, with specific traffic control filters, the flowdissector can attempt to read Ethernet header information that does not exist. This leads to the...

CVE-2026-72345

A flaw was found in the Linux kernel's mlx5 LAG Link Aggregation Group driver. An off-by-one error in the mlx5lagcreatesinglefdb function's error rollback mechanism can lead to operations on uninitialized memory or a double-free condition. This could result in system instability or a denial of...

MINI-QCC2-CGWX-FC9G

Bulletin has no description...

MINI-QP68-JF5X-MG43

Bulletin has no description...

MINI-Q9C8-JX7C-P56M

Bulletin has no description...

MINI-FJ89-W3QC-XGHW

Bulletin has no description...

MINI-32MP-5QXQ-5M4G

Bulletin has no description...

CVE-2026-49425

The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-58084

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

CVE-2026-49424

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

EUVD-2026-62338

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

CVE-2026-58084 Kernel stack disclosure via timer_settime(2)

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

CVE-2026-49423

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

CVE-2026-49425

CVE-2026-49425 is a kernel stack information disclosure in the FreeBSD compat32 subsystem (the 32-bit compatibility layer for 64-bit platforms). The kevent() handler translates a 64-bit kevent struct into a stack-declared 32-bit struct without first zeroing it , allowing an unprivileged local use...

EUVD-2026-62346

The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-49425 Kernel stack disclosure in 32-bit compatibility support

The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...