PT-2026-1250

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s netpoll functionality where a kernel warning can occur when netconsole setup fails on devices with the IFF DISABLE NETPOLL flag set. This warning aris...

[SECURITY] [DLA 4385-1] libssh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4385-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 27, 2025 https://wiki.debian.org/LTS -...

SUSE-SU-2026:20561-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after bsc1238472. - CVE-2025-38653: proc: use the same treatment to check proclseek as ones for procreaditer...

CVE-2025-13674 Access of Uninitialized Pointer in Wireshark

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service...

CVE-2025-13674

CVE-2025-13674 affects Wireshark 4.6.0: BPv7 protocol dissector crash can cause denial of service. Multiple Nessus entries corroborate a BPv7 dissector crash in 4.6.0 and note that upgrade to 4.6.3 or later mitigates the issue. The vulnerability is a crash caused by a BPv7 parser crash in Wiresha...

CVE-2025-13674 Access of Uninitialized Pointer in Wireshark

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service...

CVE-2025-13674 Access of Uninitialized Pointer in Wireshark

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service...

JLSEC-2025-324 A flaw was found in rsync which could be triggered when rsync compares file checksums

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time...

CVE-2025-13470

A flaw was found in RNP. This vulnerability allows for the trivial decryption of data encrypted using public-key encryption, fully compromising confidentiality, via an uninitialized symmetric session key in Public-Key Encrypted Session Key PKESK packets, which results in an all-zero byte array...

kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory

A use-after-free memory bug exists in the linux kernel, such that unpoisonmemory tries to check the PGHWPoison flags of an uninitialized page. So VMBUGONPAGEPagePoisonedpage is triggered, leading to damage to the system availability and integrity...

kernel: sctp: linearize cloned gso packets in sctp_rcv

A flaw use of uninitialized memory uncontrolled and invisible by attacker in the Linux kernel SCTP transport protocol was found in the way user triggers malicious SCTP packets. A remote user could use this flaw to crash the system. The bug actual only for systems where SCTP protocol being enabled...

libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

The vulnerability of the Linux operating system’s kernel’s media component, which allows a hacker to cause a service failure

The vulnerability of the Linux operating system’s kernel media component is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a attacker to cause a service failure...

The vulnerability of the video_get_user() function in the drivers/media/v4l2-core/v4l2-ioctl.c file of the Linux kernel’s multimedia device support driver allows a hacker to gain access to protected information.

The vulnerability of the videogetuser function in the drivers/media/v4l2-core/v4l2-ioctl.c file of the Linux kernel’s multimedia device support driver module is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access protected information...

openSUSE 16 Security Update : openexr (openSUSE-SU-2025-20056-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025-20056-1 advisory. - CVE-2025-64181: Fixed use of uninitialized memory in function genericunpack bsc1253233 Tenable has extracted the preceding description block directly...

Exploit for Use of Uninitialized Resource in Citrix Netscaler_Application_Delivery_Controller

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit !WARNIN...

OSV-2025-938 Use-of-uninitialized-value in comp_func_SourceOver_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=462673332 Crash type: Use-of-uninitialized-value Crash state: compfuncSourceOveravx2 blenduntransformedgeneric blenduntransformedgeneric...

SUSE CVE-2025-13470

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...

CVE-2025-13470

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...

CVE-2025-13470 RNP 0.18.0 Vulnerable PKESK session keys

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...