UBUNTU-CVE-2025-68781

In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otgevent is initialized in fslotgconf and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2...

CVE-2025-71094 net: usb: asix: validate PHY address before use

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device can return an invalid address = PHYMAXADDR, which causes a warning in...

CVE-2025-71094

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device can return an invalid address = PHYMAXADDR, which causes a warning in...

CVE-2025-71082 Bluetooth: btusb: revert use of devm_kzalloc in btusb

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devmkzalloc in btusb This reverts commit 98921dbd00c4e "Bluetooth: Use devmkzalloc in btusb.c file". In btusbprobe, we use devmkzalloc to allocate the btusb data. This ties the lifetime of all the...

CVE-2025-68819

The CVE-2025-68819 issue affects the Linux kernel’s media: dvb-usb dtv5100 code path, where dtv5100_i2c_msg() uses a user-controlled rlen without validating it against st->data size, enabling an out-of-bounds read/write. Connected sources confirm a fix was applied to perform proper range check...

CVE-2025-68783 ALSA: usb-mixer: us16x08: validate meter packet indices

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

CVE-2025-68783

CVE-2025-68783 affects the Linux kernel ALSA usb-mixer for the us16x08, where get_meter_levels_from_urb() previously derived a channel index from a meter packet without validating range, risking writes past the end of per-channel arrays when the packet contained a negative or out-of-range channel...

CVE-2025-68783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

CVE-2025-68783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices getmeterlevelsfromurb parses the 64-byte meter packets sent by the device and fills the per-channel arrays meterlevel, complevel and masterlevel in struct...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: The mcbausb driver fails to populate the ndochangemtu function, allowing for a buffer overflow. Sending a PFPACKET message allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The onl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor the bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This lead...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. An assertion failure occurred in the usbepget function in hw/net/core.c when attempting to retrieve the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Properly terminates the timer upon disconnection The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call being made. This leaves the timer in an...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fixed buffer overflow in the USB transport layer. There is a buffer overflow vulnerability in the USB 9pfs transport layer. In this case, inconsistencies in size validation between packet header parsing and actual data...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: It was resolved that holding the PM usage reference is necessary to avoid deadlocks between PM and MDIO operations along with RTNL. Prevent USB runtime PM autosuspend for AX88772 in bind. usbnet enables runtime PM...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - In the net subsystem, for USB devices, the disruptive netifwakequeue function in rtl8150setmulticast has been removed. - The syzbot tool reported a WARNING in the rtl8150startxmit/usbsubmiturb function. The sequence of event...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue The driver explicitly uses a 64-bit constant when the number of bits used for shifting is 32 as is the case with PC CAN FD interfaces supported by this driver. mkl: update subject, appl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: facm: Refactor the bind path to use free After a bind/unbind cycle, the acm-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This leads to...

ROS-20260113-7316

Vulnerability of astudcgetstatus function in drivers/usb/gadget/udc/aspeedudc.c module of usb gadget driver of Linux kernel is related to incorrect index calculation. Exploitation of the vulnerability may allow an intruder to affect confidentiality, integrity and availability of protected...

MiracleLinux 7 : kernel-3.10.0-1160.139.1.0.1.el7.AXS7 (AXSA:2025-11327:91)

"The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11327:91 advisory. ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 ext4: fix memory leak in ext4fillsuper net: defer final...