Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: dvb-core: Fixed an issue where incorrect reinitializations of the ringbuffer occurred upon reopening the device. The dvbdvropen function calls dvbringbufferinit, when a new reader opens the DVR device. dvbringbufferinit th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: Fixed an uninitialized value in ocfs2filereaditer. Syzbot has reported the following KMSAN errors: BUG: KMSAN: Uninitialized value in ocfs2filereaditer+0x9a4/0xf80; ocfs2filereaditer+0x9a4/0xf80; ioread+0x8d4/0x20f0;...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restricted kiocbsetcancelfn to I/O submitted via libaio. If kiocbsetcancelfn is called for I/O submitted via iouring, the following kernel warning appears: WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocbsetcancelfn+0x9c/0x...

SUSE CVE-2026-90095

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

OESA-2026-3987 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL whil...

DEBIAN-CVE-2026-90095

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

CVE-2026-90095

CVE-2026-90095 affects the Linux kernel FUSE subsystem. The root cause is a missing condition in fuse_uring_cmd() that failed to refuse IORING_OP_URING_CMD when the FUSE_OVER_IO_URING flag was absent from the FUSE_INIT reply. Without this guard, the barrier in fuse_uring_ready() does not function...

EUVD-2026-81956

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

PT-2026-94399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where devmem TX is not properly enforced to require zero-copy when NETIF F SG is absent. In such scenarios, the tcp sendmsg locked function...

PT-2026-94443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the fuse implementation where the fuse uring cmd function fails to refuse IORING OP URING CMD requests if the connection was not enabled due to a missing FUSE OVER IO...

PT-2026-94671

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ublk component where the use of UBLK F AUTO BUF REG allows an invalid sqe-addr to cause a failure after ublk fill io cmd has set the UBLK IO FLAG ACTIVE flag. This...

CVE-2026-90095: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

PT-2026-93650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the scsi bsg uring cmd function. The function reads bsg uring cmd from a shared memory-mapped Submission Queue Entry SQE. A user can...

Astra Linux – Vulnerability in Linux 5.10

There is a vulnerability related to time-of-check to time-of-use issues in the iouringsubsystem’s IORINGOPCLOSE operation in the Linux kernel versions 5.6 to 5.11 inclusive. This vulnerability allows a local user to elevate their privileges to root. Introduced in the version...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nullblk: fixed handling of poll request timeouts When performing the iouring benchmark on /dev/nullb0, it’s easy for the kernel to crash if poll requests time out, as reported by David. 1 BUG: Kernel NULL pointer dereferencing...

SUSE CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

Linux Distros Unpatched Vulnerability : CVE-2026-80946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back...

CVE-2026-80946

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. The io-uring transport attempts to copy request headers directly to or from user space without proper memory validation. A local attacker could exploit this vulnerability, leading to a kernel panic and a denial of...

CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

UBUNTU-CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...