{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from\n the prior 4.19.0-28.\n * CVE-2021-46984\n - kyber: fix out of bounds access when preempted {CVE-2021-46984}\n * CVE-2021-47049\n - Drivers: hv: vmbus: Use after free in __vmbus_open()\n {CVE-2021-47049}\n * CVE-2021-47101\n - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}\n * CVE-2021-47191\n - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n {CVE-2021-47191}\n * CVE-2021-47352\n - virtio-net: Add validation for used length {CVE-2021-47352}\n * CVE-2021-47379\n - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg\n pd {CVE-2021-47379}\n * CVE-2021-47391\n - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more\n requests {CVE-2021-47391}\n * CVE-2021-47479\n - staging: rtl8712: fix use-after-free in rtl8712_dl_fw\n {CVE-2021-47479}\n * CVE-2022-21546\n - scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}\n * CVE-2022-39189\n - KVM: x86: do not report a vCPU as preempted outside instruction\n boundaries {CVE-2022-39189}\n * CVE-2022-43945\n - SUNRPC: Fix svcxdr_init_encode's buflen calculation\n {CVE-2022-43945}\n - NFSD: Cap rsize_bop result based on send buffer size\n {CVE-2022-43945}\n * CVE-2022-48744\n - net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}\n * CVE-2022-49026\n - e100: Fix possible use after free in e100_xmit_prepare\n {CVE-2022-49026}\n * CVE-2022-49720\n - block: Fix handling of offline queues in\n blk_mq_alloc_request_hctx() {CVE-2022-49720}\n * CVE-2022-49975\n - bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}\n - bpf: Move skb->len == 0 checks into __bpf_redirect\n {CVE-2022-49975}\n * CVE-2022-50066\n - net: atlantic: fix aq_vec index out of range error\n {CVE-2022-50066}\n * CVE-2022-50103\n - sched, cpuset: Fix dl_cpu_busy() panic due to empty\n cs->cpus_allowed {CVE-2022-50103}\n * CVE-2022-50129\n - RDMA/srpt: Introduce a reference count in struct srpt_device\n {CVE-2022-50129}\n - RDMA/srpt: Fix a use-after-free {CVE-2022-50129}\n * CVE-2022-50300\n - btrfs: fix extent map use-after-free when handling missing device\n in read_one_chunk {CVE-2022-50300}\n * CVE-2022-50406\n - iomap: iomap: fix memory corruption when recording errors during\n writeback {CVE-2022-50406}\n * CVE-2022-50422\n - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n {CVE-2022-50422}\n * CVE-2022-50552\n - blk-mq: use quiesced elevator switch when reinitializing queues\n {CVE-2022-50552}\n * CVE-2023-51779\n - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg\n {CVE-2023-51779}\n * CVE-2023-52434\n - smb: client: fix potential OOBs in smb2_parse_contexts()\n {CVE-2023-52434}\n * CVE-2023-52515\n - RDMA/srp: Do not call scsi_done() from srp_abort()\n {CVE-2023-52515}\n * CVE-2023-52531\n - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}\n * CVE-2023-52741\n - cifs: Fix use-after-free in rdata->read_into_pages()\n {CVE-2023-52741}\n * CVE-2023-53000\n - netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}\n * CVE-2023-53039\n - workqueue: Add resource managed version of delayed work init\n {CVE-2023-53039}\n - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc\n {CVE-2023-53039}\n - devm-helpers: Add resource managed version of work init\n {CVE-2023-53039}\n - HID: intel-ish-hid: ipc: Fix potential use-after-free in work\n function {CVE-2023-53039}\n - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized\n dev->devc {CVE-2023-53039}\n * CVE-2023-53111\n - loop: Fix use-after-free issues {CVE-2023-53111}\n * CVE-2023-53254\n - cacheinfo: Fix shared_cpu_map to handle shared caches at different\n levels {CVE-2023-53254}\n * CVE-2023-53259\n - VMCI: check context->notify_page after call to\n get_user_pages_fast() to avoid GPF {CVE-2023-53259}\n * CVE-2023-53282\n - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs\n firmware write {CVE-2023-53282}\n * CVE-2023-53321\n - wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}\n * CVE-2023-53333\n - netfilter: conntrack: dccp: copy entire header to stack buffer,\n not just basic one {CVE-2023-53333}\n - netfilter: conntrack: dccp: try not to drop skb in conntrack\n {CVE-2023-53333}\n * CVE-2023-53432\n - firewire: net: fix use after free in\n fwnet_finish_incoming_packet() {CVE-2023-53432}\n * CVE-2023-53510\n - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}\n * CVE-2023-53577\n - bpf, cpumap: Make sure kthread is running before map update\n returns {CVE-2023-53577}\n * CVE-2023-53680\n - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL\n {CVE-2023-53680}\n * CVE-2024-26689\n - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}\n * CVE-2024-26828\n - cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828}\n * CVE-2024-26996\n - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep\n transport error {CVE-2024-26996}\n * CVE-2024-35791\n - KVM: SVM: Flush pages under kvm->lock to fix UAF in\n svm_register_enc_region() {CVE-2024-35791}\n * CVE-2024-35864\n - smb: client: fix potential UAF in smb2_is_valid_lease_break()\n {CVE-2024-35864}\n * CVE-2024-35932\n - drm/vc4: don't check if plane->state->fb == state->fb\n {CVE-2024-35932}\n * CVE-2024-38545\n - RDMA/hns: Fix UAF for cq async event {CVE-2024-38545}\n * CVE-2024-38588\n - ftrace: Fix possible use-after-free issue in ftrace_location()\n {CVE-2024-38588}\n * CVE-2024-40929\n - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids\n {CVE-2024-40929}\n * CVE-2024-41013\n - xfs: don't walk off the end of a directory data block\n {CVE-2024-41013}\n * CVE-2024-42120\n - drm/amd/display: Check pipe offset before setting vblank\n {CVE-2024-42120}\n * CVE-2024-46731\n - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}\n * CVE-2024-46813\n - drm/amd/display: Check link_index before accessing dc->links[]\n {CVE-2024-46813}\n * CVE-2024-46818\n - drm/amd/display: Check gpio_id before used as array index\n {CVE-2024-46818}\n * CVE-2024-46826\n - ELF: fix kernel.randomize_va_space double read {CVE-2024-46826}\n * CVE-2024-46859\n - platform/x86: panasonic-laptop: Fix sticky key init bug\n {CVE-2024-46859}\n - platform/x86: panasonic-laptop: Fix SINF array out of bounds\n accesses {CVE-2024-46859}\n * CVE-2024-49991\n - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer\n {CVE-2024-49991}\n * CVE-2024-50036\n - net: do not delay dst_entries_add() in dst_release()\n {CVE-2024-50036}\n * CVE-2024-50067\n - uprobe: avoid out-of-bounds memory access of fetching args\n {CVE-2024-50067}\n * CVE-2024-50073\n - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}\n * CVE-2024-50256\n - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()\n {CVE-2024-50256}\n * CVE-2024-53090\n - afs: Fix lock recursion {CVE-2024-53090}\n * CVE-2024-53124\n - net: fix data-races around sk->sk_forward_alloc {CVE-2024-53124}\n * CVE-2024-56593\n - wifi: brcmfmac: Fix oops due to NULL pointer dereference in\n brcmf_sdiod_sglist_rw() {CVE-2024-56593}\n * CVE-2024-56602\n - net: ieee802154: do not leave a dangling sk pointer in\n ieee802154_create() {CVE-2024-56602}\n * CVE-2024-56603\n - net: af_can: do not leave a dangling sk pointer in can_create()\n {CVE-2024-56603}\n * CVE-2024-56606\n - af_packet: avoid erroring out after sock_init_data() in\n packet_create() {CVE-2024-56606}\n * CVE-2024-56631\n - scsi: sg: Fix slab-use-after-free read in sg_release()\n {CVE-2024-56631}\n * CVE-2024-56640\n - net/smc: fix LGR and link use-after-free issue {CVE-2024-56640}\n * CVE-2024-56650\n - netfilter: x_tables: fix LED ID check in led_tg_check()\n {CVE-2024-56650}\n * CVE-2024-56658\n - net: defer final 'struct net' free in netns dismantle\n {CVE-2024-56658}\n * CVE-2024-56748\n - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()\n {CVE-2024-56748}\n * CVE-2024-56756\n - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}\n * CVE-2024-57901\n - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK\n {CVE-2024-57901}\n * CVE-2024-58072\n - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}\n * CVE-2025-21749\n - net: rose: add missing dev_put() on error in rose_bind\n {CVE-2025-21749}\n * CVE-2025-21858\n - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}\n * CVE-2025-22022\n - usb: xhci: move link chain bit quirk checks into one helper\n function. {CVE-2025-22022}\n - usb: xhci: Apply the link chain quirk on NEC isoc endpoints\n {CVE-2025-22022}\n - usb: xhci: Don't unchain link TRBs on quirky HCs {CVE-2025-22022}\n * CVE-2025-22083\n - vhost-scsi: Fix handling of multiple calls to\n vhost_scsi_set_endpoint {CVE-2025-22083}\n * CVE-2025-22121\n - ext4: introduce ITAIL helper {CVE-2025-22121}\n - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n {CVE-2025-22121}\n * CVE-2025-23156\n - media: venus: hfi_parser: refactor hfi packet parsing logic\n {CVE-2025-23156}\n * CVE-2025-23157\n - media: venus: hfi_parser: add check to avoid out of bound access\n {CVE-2025-23157}\n * CVE-2025-23158\n - media: venus: hfi: add check to handle incorrect queue size\n {CVE-2025-23158}\n * CVE-2025-37796\n - wifi: at76c50x: fix use after free access in at76_disconnect\n {CVE-2025-37796}\n * CVE-2025-37798\n - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()\n {CVE-2025-37798}\n * CVE-2025-37839\n - jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}\n * CVE-2025-37879\n - 9p/net: fix improper handling of bogus negative read/write replies\n {CVE-2025-37879}\n * CVE-2025-37882\n - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling\n {CVE-2025-37882}\n * CVE-2025-37923\n - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}\n - tracing: Fix compilation warning on arm32 {CVE-2025-37923}\n * CVE-2025-37927\n - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid\n {CVE-2025-37927}\n * CVE-2025-37932\n - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}\n * CVE-2025-37953\n - sch_htb: make htb_deactivate() idempotent {CVE-2025-37953}\n * CVE-2025-38000\n - sch_hfsc: Fix qlen accounting bug when using peek in\n hfsc_enqueue() {CVE-2025-38000}\n * CVE-2025-38024\n - RDMA/rxe: Zero out index member of struct rxe_queue\n {CVE-2025-38024}\n - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug\n {CVE-2025-38024}\n * CVE-2025-38068\n - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}\n * CVE-2025-38079\n - crypto: algif_hash - fix double free in hash_accept\n {CVE-2025-38079}\n * CVE-2025-38102\n - VMCI: fix race between vmci_host_setup_notify and\n vmci_ctx_unset_notify {CVE-2025-38102}\n * CVE-2025-38103\n - HID: usbhid: Eliminate recurrent out-of-bounds bug in\n usbhid_parse() {CVE-2025-38103}\n - HID: usbhid: paper over wrong bNumDescriptor field\n {CVE-2025-38103}\n * CVE-2025-38157\n - wifi: ath9k_htc: Abort software beacon handling if disabled\n {CVE-2025-38157}\n * CVE-2025-38211\n - RDMA/iwcm: Fix use-after-free of work objects after cm_id\n destruction {CVE-2025-38211}\n * CVE-2025-38212\n - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}\n * CVE-2025-38348\n - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()\n {CVE-2025-38348}\n * CVE-2025-38350\n - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}\n - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}\n - net/sched: Always pass notifications when child class becomes\n empty {CVE-2025-38350}\n * CVE-2025-38375\n - virtio-net: ensure the received length does not exceed allocated\n size {CVE-2025-38375}\n * CVE-2025-38403\n - vsock/vmci: Clear the vmci transport packet properly when\n initializing it {CVE-2025-38403}\n * CVE-2025-38445\n - md/raid1: Fix stack memory use after return in raid1_reshape\n {CVE-2025-38445}\n * CVE-2025-38494\n - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}\n * CVE-2025-38497\n - usb: gadget: configfs: Fix OOB read on empty string write\n {CVE-2025-38497}\n * CVE-2025-38563\n - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}\n * CVE-2025-38565\n - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}\n * CVE-2025-38572\n - ipv6: reject malicious packets in ipv6_gso_segment()\n {CVE-2025-38572}\n * CVE-2025-38618\n - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}\n * CVE-2025-38652\n - f2fs: fix to avoid out-of-boundary access in devs.path\n {CVE-2025-38652}\n * CVE-2025-38679\n - media: venus: Fix OOB read due to missing payload bound check\n {CVE-2025-38679}\n * CVE-2025-38708\n - drbd: add missing kref_get in handle_write_conflicts\n {CVE-2025-38708}\n * CVE-2025-38718\n - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}\n * CVE-2025-38728\n - smb3: fix for slab out of bounds on mount to ksmbd\n {CVE-2025-38728}\n * CVE-2025-38729\n - ALSA: usb-audio: Validate UAC3 power domain descriptors, too\n {CVE-2025-38729}\n * CVE-2025-39684\n - comedi: Fix use of uninitialized memory in do_insn_ioctl() and\n do_insnlist_ioctl() {CVE-2025-39684}\n * CVE-2025-39686\n - comedi: Make insn_rw_emulate_bits() do insn->n samples\n {CVE-2025-39686}\n * CVE-2025-39689\n - ftrace: Also allocate and copy hash for reading of filter files\n {CVE-2025-39689}\n * CVE-2025-39702\n - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}\n * CVE-2025-39730\n - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n {CVE-2025-39730}\n * CVE-2025-39760\n - usb: core: config: Prevent OOB read in SS endpoint companion\n parsing {CVE-2025-39760}\n - usb: core: config: reverse the size check of the SSP isoc endpoint\n descriptor {CVE-2025-39760}\n * CVE-2025-39817\n - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare\n {CVE-2025-39817}\n * CVE-2025-39823\n - KVM: x86: use array_index_nospec with indices that come from guest\n {CVE-2025-39823}\n - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi\n {CVE-2025-39823}\n * CVE-2025-39824\n - HID: asus: fix UAF via HID_CLAIMED_INPUT validation\n {CVE-2025-39824}\n * CVE-2025-39839\n - batman-adv: fix OOB read/write in network-coding decode\n {CVE-2025-39839}\n * CVE-2025-39853\n - i40e: Fix potential invalid access when MAC list is empty\n {CVE-2025-39853}\n * CVE-2025-39863\n - wifi: brcmfmac: fix use-after-free when rescheduling\n brcmf_btcoex_info work {CVE-2025-39863}\n * CVE-2025-39891\n - wifi: mwifiex: Initialize the chan_stats array to zero\n {CVE-2025-39891}\n * CVE-2025-39901\n - i40e: remove read access to debugfs files {CVE-2025-39901}\n * CVE-2025-39911\n - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path\n {CVE-2025-39911}\n * CVE-2025-39955\n - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().\n {CVE-2025-39955}\n * CVE-2025-40186\n - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().\n {CVE-2025-40186}\n * CVE-2025-68305\n - Bluetooth: hci_sock: Prevent race in socket write iter and sock\n bind {CVE-2025-68305}\n * CVE-2025-71075\n - scsi: aic94xx: fix use-after-free in device removal path\n {CVE-2025-71075}\n * CVE-2025-71082\n - Bluetooth: btusb: revert use of devm_kzalloc in btusb\n {CVE-2025-71082}\n * CVE-2025-71091\n - team: fix check for port enabled in\n team_queue_override_port_prio_changed() {CVE-2025-71091}\n * CVE-2025-71093\n - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}\n * CVE-2025-71116\n - libceph: make decode_pool() more resilient against corrupted\n osdmaps {CVE-2025-71116}\n * CVE-2026-22980\n - nfsd: provide locking for v4_end_grace {CVE-2026-22980}\n * CVE-2026-23001\n - macvlan: fix possible UAF in macvlan_forward_source()\n {CVE-2026-23001}\n * CVE-2026-23073\n - wifi: rsi: Fix memory corruption due to not set vif driver data\n size {CVE-2026-23073}\n * CVE-2026-23076\n - ALSA: ctxfi: Fix potential OOB access in audio mixer handling\n {CVE-2026-23076}\n * CVE-2026-23083\n - fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083}\n * CVE-2026-23089\n - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\n {CVE-2026-23089}\n * CVE-2026-23099\n - bonding: limit BOND_MODE_8023AD to Ethernet devices\n {CVE-2026-23099}\n * CVE-2026-23191\n - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}\n * CVE-2026-23193\n - scsi: target: iscsi: Fix use-after-free in\n iscsit_dec_session_usage_count() {CVE-2026-23193}\n * CVE-2026-23204\n - net: add skb_header_pointer_careful() helper {CVE-2026-23204}\n - net/sched: cls_u32: use skb_header_pointer_careful()\n {CVE-2026-23204}\n * CVE-2026-23216\n - scsi: target: iscsi: Fix use-after-free in\n iscsit_dec_conn_usage_count() {CVE-2026-23216}\n * CVE-2026-23231\n - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()\n {CVE-2026-23231}\n * CVE-2026-23235\n - f2fs: fix out-of-bounds access in sysfs attribute read/write\n {CVE-2026-23235}\n * CVE-2026-23243\n - RDMA/umad: Reject negative data_len in ib_umad_write\n {CVE-2026-23243}\n * CVE-2026-23273\n - macvlan: observe an RCU grace period in macvlan_common_newlink()\n error path {CVE-2026-23273}\n * CVE-2026-23281\n - wifi: libertas: fix use-after-free in lbs_free_adapter()\n {CVE-2026-23281}\n * CVE-2026-23372\n - nfc: rawsock: cancel tx_work before socket teardown\n {CVE-2026-23372}\n * CVE-2026-23378\n - net/sched: act_ife: Fix metalist update behavior {CVE-2026-23378}\n * CVE-2026-23388\n - Squashfs: check metadata block offset is within range\n {CVE-2026-23388}\n * CVE-2026-23406\n - apparmor: fix side-effect bug in match_char() macro usage\n {CVE-2026-23406}\n * CVE-2026-23447\n - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check\n {CVE-2026-23447}\n * CVE-2026-23448\n - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n {CVE-2026-23448}\n * CVE-2026-31396\n - net: macb: fix use-after-free access to PTP clock {CVE-2026-31396}\n * CVE-2026-31399\n - nvdimm/bus: Fix potential use after free in asynchronous\n initialization {CVE-2026-31399}\n * CVE-2026-31452\n - ext4: convert inline data to extents when truncate exceeds inline\n size {CVE-2026-31452}\n * CVE-2026-31494\n - net: macb: use the current queue number for stats {CVE-2026-31494}\n * CVE-2026-31500\n - Bluetooth: btintel: serialize btintel_hw_error() with\n hci_req_sync_lock {CVE-2026-31500}\n * CVE-2026-31532\n - can: raw: fix ro->uniq use-after-free in raw_rcv()\n {CVE-2026-31532}\n * CVE-2026-31576\n - media: hackrf: fix to not free memory after the device is\n registered in hackrf_probe() {CVE-2026-31576}\n * CVE-2026-31581\n - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}\n * CVE-2026-31597\n - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY\n {CVE-2026-31597}\n * CVE-2026-31602\n - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}\n * CVE-2026-31622\n - NFC: digital: Bounds check NFC-A cascade depth in SDD response\n handler {CVE-2026-31622}\n * CVE-2026-31626\n - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()\n {CVE-2026-31626}\n * CVE-2026-31627\n - i2c: s3c24xx: check the size of the SMBUS message before using it\n {CVE-2026-31627}\n * CVE-2026-31629\n - nfc: llcp: add missing return after LLCP_CLOSED checks\n {CVE-2026-31629}\n * CVE-2026-31659\n - batman-adv: reject oversized global TT response buffers\n {CVE-2026-31659}\n * CVE-2026-31696\n - rxrpc: Fix missing validation of ticket length in non-XDR key\n preparsing {CVE-2026-31696}\n * CVE-2026-31747\n - comedi: me4000: Fix potential overrun of firmware buffer\n {CVE-2026-31747}\n * CVE-2026-31748\n - comedi: me_daq: Fix potential overrun of firmware buffer\n {CVE-2026-31748}\n * CVE-2026-31778\n - ALSA: caiaq: fix stack out-of-bounds read in init_card\n {CVE-2026-31778}\n * CVE-2026-31787\n - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}\n * CVE-2026-43020\n - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}\n * CVE-2026-43027\n - netfilter: nf_conntrack_helper: pass helper to expect cleanup\n {CVE-2026-43027}\n * CVE-2026-43040\n - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize\n nduseropt_padX fields to zero to prevent an info-leak\n {CVE-2026-43040}\n * CVE-2026-43052\n - wifi: mac80211: check tdls flag in ieee80211_tdls_oper\n {CVE-2026-43052}\n * CVE-2026-43075\n - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n {CVE-2026-43075}\n * CVE-2026-43076\n - ocfs2: validate inline data i_size during inode read\n {CVE-2026-43076}\n * CVE-2026-43198\n - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}\n * CVE-2026-43206\n - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n {CVE-2026-43206}\n * CVE-2026-43279\n - ALSA: usb-audio: Add sanity check for OOB writes at silencing\n {CVE-2026-43279}\n * CVE-2026-43281\n - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n {CVE-2026-43281}\n * CVE-2026-43370\n - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}\n * CVE-2026-43386\n - staging: rtl8723bs: fix potential out-of-bounds read in\n rtw_restruct_wmm_ie {CVE-2026-43386}\n * CVE-2026-43427\n - usb: class: cdc-wdm: fix reordering issue in read code path\n {CVE-2026-43427}\n * CVE-2026-43450\n - netfilter: nfnetlink_cthelper: fix OOB read in\n nfnl_cthelper_dump_table() {CVE-2026-43450}\n * CVE-2026-43494\n - net/rds: reset op_nents when zerocopy page pin fails\n {CVE-2026-43494}\n * CVE-2026-45893\n - apparmor: Fix & Optimize table creation from possibly unaligned\n memory {CVE-2026-45893}\n * CVE-2026-46006\n - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n {CVE-2026-46006}\n * CVE-2026-46022\n - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n {CVE-2026-46022}\n * CVE-2026-46033\n - crypto: authencesn - reject short ahash digests during instance\n creation {CVE-2026-46033}\n * CVE-2026-46069\n - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n {CVE-2026-46069}\n * CVE-2026-46116\n - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n {CVE-2026-46116}\n * CVE-2026-46150\n - fanotify: fix false positive on permission events {CVE-2026-46150}\n * CVE-2026-46191\n - fbcon: Avoid OOB font access if console rotation fails\n {CVE-2026-46191}\n * CVE-2026-46208\n - batman-adv: stop tp_meter sessions during mesh teardown\n {CVE-2026-46208}\n * CVE-2026-46209\n - drm/gem: Fix inconsistent plane dimension calculation in\n drm_gem_fb_init_with_funcs() {CVE-2026-46209}\n * CVE-2026-46218\n - drm/amdgpu: Add bounds checking to ib_{get,set}_value\n {CVE-2026-46218}\n * CVE-2026-46254\n - AppArmor: Allow apparmor to handle unaligned dfa tables\n {CVE-2026-46254}\n * CVE-2026-46259\n - procfs: fix missing RCU protection when reading real_parent in\n do_task_stat() {CVE-2026-46259}\n * CVE-2026-46333\n - ptrace: slightly saner 'get_dumpable()' logic {CVE-2026-46333}\n * CVE-2026-52934\n - batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}\n * CVE-2026-53009\n - ice: fix double-free of tx_buf skb {CVE-2026-53009}\n * CVE-2026-53036\n - bpf, arm64: Fix off-by-one in check_imm signed range check\n {CVE-2026-53036}\n * CVE-2026-53040\n - ocfs2: validate bg_bits during freefrag scan {CVE-2026-53040}\n * CVE-2026-53075\n - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n {CVE-2026-53075}\n * CVE-2026-53091\n - net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}\n * CVE-2026-53130\n - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n {CVE-2026-53130}\n * CVE-2026-53136\n - drm/amd/display: Clamp VBIOS HDMI retimer register count to array\n size {CVE-2026-53136}\n * CVE-2026-53138\n - drm/amd/display: Bound VBIOS record-chain walk loops\n {CVE-2026-53138}\n * CVE-2026-53186\n - RDMA/srp: bound SRP_RSP sense copy by the received length\n {CVE-2026-53186}\n * CVE-2026-53189\n - mm/huge_memory: update file PMD counter before folio_put()\n {CVE-2026-53189}\n * CVE-2026-53224\n - sctp: validate embedded INIT chunk and address list lengths in\n cookie {CVE-2026-53224}\n * CVE-2026-53228\n - ipv6: sit: reload inner IPv6 header after GSO offloads\n {CVE-2026-53228}\n * CVE-2026-53246\n - sctp: validate cached peer INIT chunk length in COOKIE_ECHO\n processing {CVE-2026-53246}\n * CVE-2026-53264\n - net/sched: act_api: use RCU with deferred freeing for action\n lifecycle {CVE-2026-53264}\n * CVE-2026-53270\n - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}\n * CVE-2026-53303\n - f2fs: protect extension_list reading with sb_lock in\n f2fs_sbi_show() {CVE-2026-53303}\n * CVE-2026-64567\n - btrfs: reject free space cache with more entries than pages\n {CVE-2026-64567}\n * CVE-2026-64571\n - wifi: p54: validate RX frame length in p54_rx_eeprom_readback()\n {CVE-2026-64571}\n * CVE-2026-64580\n - xfrm6: clear dst.dev on error to avoid double netdev_put in\n xfrm6_fill_dst() {CVE-2026-64580}\n * CVE-2026-64581\n - xfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n {CVE-2026-64581}\n * CVE-2026-64582\n - RDMA/rxe: Fix a use-after-free problem in rxe_mmap\n {CVE-2026-64582}\n * CVE-2026-64584\n - usb: gadget: f_midi: cancel pending IN work before freeing the\n midi object {CVE-2026-64584}\n * CVE-2026-64585\n - can: esd_usb: kill anchored URBs before freeing netdevs\n {CVE-2026-64585}\n * CVE-2026-64587\n - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n {CVE-2026-64587}\n * CVE-2026-64593\n - btrfs: do not trim a device which is not writeable\n {CVE-2026-64593}", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/advisories/2026/clsa-2026_1788449727.json" } ], "tracking": { "current_release_date": "2026-09-03T15:59:00Z", "generator": { "date": "2026-09-03T15:59:00Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1788449727", "initial_release_date": "2026-09-03T15:59:00Z", "revision_history": [ { "date": "2026-09-03T15:59:00Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix of 223 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 10", "product": { "name": "Debian 10", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-kbuild-4.19@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libbpf4.19@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-image-4.19.0-29-amd64-unsigned@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-29-amd64@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-perf-4.19@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-29-all-amd64@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-29-all@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-libc-dev@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcpupower1@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-config-4.19@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/hyperv-daemons@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcpupower-dev@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libbpf-dev@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-image-amd64-signed-template@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-compiler-gcc-8-x86@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "product": { "name": "linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "product_id": "linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-cpupower@4.19.325-2%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-28-all-amd64@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-libc-dev@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcpupower1@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libcpupower-dev@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libbpf-dev@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-perf-4.19@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-config-4.19@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-kbuild-4.19@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libbpf4.19@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-compiler-gcc-8-x86@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-28-all@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-image-amd64-signed-template@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-cpupower@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-28-amd64@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/hyperv-daemons@4.19.325-1%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "product": { "name": "linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "product_id": "linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-image-4.19.0-28-amd64-unsigned@4.19.325-1%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "product": { "name": "linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "product_id": "linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-source-4.19@4.19.325-2%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "product": { "name": "linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "product_id": "linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-29-common@4.19.325-2%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "product": { "name": "linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "product_id": "linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-doc-4.19@4.19.325-2%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all", "product": { "name": "linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all", "product_id": "linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-support-4.19.0-29@4.19.325-2%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "product": { "name": "linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "product_id": "linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-doc-4.19@4.19.325-1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all", "product": { "name": "linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all", "product_id": "linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-support-4.19.0-28@4.19.325-1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "product": { "name": "linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "product_id": "linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-source-4.19@4.19.325-1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "product": { "name": "linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "product_id": "linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/linux-headers-4.19.0-28-common@4.19.325-1%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-source-4.19-0:4.19.325-2+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all" }, "product_reference": "linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libcpupower1-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all" }, "product_reference": "linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all" }, "product_reference": "linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" }, "product_reference": "linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64" }, "product_reference": "linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libcpupower1-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all" }, "product_reference": "linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" }, "product_reference": "linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-source-4.19-0:4.19.325-1+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all" }, "product_reference": "linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all" }, "product_reference": "linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64 as a component of Debian 10", "product_id": "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64" }, "product_reference": "linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-31778", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31778" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234", "url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0", "url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6", "url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed", "url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46150", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46150" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc", "url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11", "url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900", "url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678", "url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a", "url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc", "url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538", "url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f", "url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f" } ], "release_date": "2026-05-28T09:36:06Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T09:36:06Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38348", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()\n\nRobert Morris reported:\n\n|If a malicious USB device pretends to be an Intersil p54 wifi\n|interface and generates an eeprom_readback message with a large\n|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the\n|message beyond the end of priv->eeprom.\n|\n|static void p54_rx_eeprom_readback(struct p54_common *priv,\n| struct sk_buff *skb)\n|{\n| struct p54_hdr *hdr = (struct p54_hdr *) skb->data;\n| struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;\n|\n| if (priv->fw_var >= 0x509) {\n| memcpy(priv->eeprom, eeprom->v2.data,\n| le16_to_cpu(eeprom->v2.len));\n| } else {\n| memcpy(priv->eeprom, eeprom->v1.data,\n| le16_to_cpu(eeprom->v1.len));\n| }\n| [...]\n\nThe eeprom->v{1,2}.len is set by the driver in p54_download_eeprom().\nThe device is supposed to provide the same length back to the driver.\nBut yes, it's possible (like shown in the report) to alter the value\nto something that causes a crash/panic due to overrun.\n\nThis patch addresses the issue by adding the size to the common device\ncontext, so p54_rx_eeprom_readback no longer relies on possibly tampered\nvalues... That said, it also checks if the \"firmware\" altered the value\nand no longer copies them.\n\nThe one, small saving grace is: Before the driver tries to read the eeprom,\nit needs to upload >a< firmware. the vendor firmware has a proprietary\nlicense and as a reason, it is not present on most distributions by\ndefault.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38348" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e4dc150423b829c35cbcf399481ca11594fc036", "url": "https://git.kernel.org/stable/c/0e4dc150423b829c35cbcf399481ca11594fc036" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12134f79e53eb56b0b0b7447fa0c512acf6a8422", "url": "https://git.kernel.org/stable/c/12134f79e53eb56b0b0b7447fa0c512acf6a8422" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f7f8168abe8cbe845ab8bb557228d44784a6b57", "url": "https://git.kernel.org/stable/c/1f7f8168abe8cbe845ab8bb557228d44784a6b57" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6d05390d20f110de37d051a3e063ef0a542d01fb", "url": "https://git.kernel.org/stable/c/6d05390d20f110de37d051a3e063ef0a542d01fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/714afb4c38edd19a057d519c1f9c5d164b43de94", "url": "https://git.kernel.org/stable/c/714afb4c38edd19a057d519c1f9c5d164b43de94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9701f842031b825e2fd5f22d064166f8f13f6e4d", "url": "https://git.kernel.org/stable/c/9701f842031b825e2fd5f22d064166f8f13f6e4d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da1b9a55ff116cb040528ef664c70a4eec03ae99", "url": "https://git.kernel.org/stable/c/da1b9a55ff116cb040528ef664c70a4eec03ae99" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f39b2f8c1549a539846e083790fad396ef6cd802", "url": "https://git.kernel.org/stable/c/f39b2f8c1549a539846e083790fad396ef6cd802" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-10T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-10T09:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64567", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64567" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78", "url": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039", "url": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2", "url": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f", "url": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69", "url": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350", "url": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363", "url": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c", "url": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c" } ], "release_date": "2026-08-05T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-05T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53039", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: ipc: Fix potential use-after-free in work function\n\nWhen a reset notify IPC message is received, the ISR schedules a work\nfunction and passes the ISHTP device to it via a global pointer\nishtp_dev. If ish_probe() fails, the devm-managed device resources\nincluding ishtp_dev are freed, but the work is not cancelled, causing a\nuse-after-free when the work function tries to access ishtp_dev. Use\ndevm_work_autocancel() instead, so that the work is automatically\ncancelled if probe fails.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53039" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5", "url": "https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785", "url": "https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836", "url": "https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0", "url": "https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0" } ], "release_date": "2025-05-02T15:54:57Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-02T15:54:57Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23231", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix use-after-free in nf_tables_addchain()\n\nnf_tables_addchain() publishes the chain to table->chains via\nlist_add_tail_rcu() (in nft_chain_add()) before registering hooks.\nIf nf_tables_register_hook() then fails, the error path calls\nnft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()\nwith no RCU grace period in between.\n\nThis creates two use-after-free conditions:\n\n 1) Control-plane: nf_tables_dump_chains() traverses table->chains\n under rcu_read_lock(). A concurrent dump can still be walking\n the chain when the error path frees it.\n\n 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly\n installs the IPv4 hook before IPv6 registration fails. Packets\n entering nft_do_chain() via the transient IPv4 hook can still be\n dereferencing chain->blob_gen_X when the error path frees the\n chain.\n\nAdd synchronize_rcu() between nft_chain_del() and the chain destroy\nso that all RCU readers -- both dump threads and in-flight packet\nevaluation -- have finished before the chain is freed.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23231" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33", "url": "https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b", "url": "https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81", "url": "https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533", "url": "https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28", "url": "https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a", "url": "https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ], "release_date": "2026-03-04T12:58:42Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-04T12:58:42Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53303", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()\n\nIn f2fs_sbi_show(), the extension_list, extension_count and\nhot_ext_count are read without holding sbi->sb_lock. If a concurrent\nsysfs store modifies the extension list via f2fs_update_extension_list(),\nthe show path may read inconsistent count and array contents, potentially\nleading to out-of-bounds access or displaying stale data.\n\nFix this by holding sb_lock around the entire extension list read\nand format operation.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53303" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025", "url": "https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194", "url": "https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb", "url": "https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428", "url": "https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647", "url": "https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e", "url": "https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e" } ], "release_date": "2026-06-26T20:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-26T20:17:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52741", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata->read_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n Call Trace:\n \n dump_stack_lvl+0x38/0x4c\n print_report+0x16f/0x4a6\n kasan_report+0xb7/0x130\n readpages_fill_pages+0x14c/0x7e0\n cifs_readv_receive+0x46d/0xa40\n cifs_demultiplex_thread+0x121c/0x1490\n kthread+0x16b/0x1a0\n ret_from_fork+0x2c/0x50\n \n\n Allocated by task 2535:\n kasan_save_stack+0x22/0x50\n kasan_set_track+0x25/0x30\n __kasan_kmalloc+0x82/0x90\n cifs_readdata_direct_alloc+0x2c/0x110\n cifs_readdata_alloc+0x2d/0x60\n cifs_readahead+0x393/0xfe0\n read_pages+0x12f/0x470\n page_cache_ra_unbounded+0x1b1/0x240\n filemap_get_pages+0x1c8/0x9a0\n filemap_read+0x1c0/0x540\n cifs_strict_readv+0x21b/0x240\n vfs_read+0x395/0x4b0\n ksys_read+0xb8/0x150\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n Freed by task 79:\n kasan_save_stack+0x22/0x50\n kasan_set_track+0x25/0x30\n kasan_save_free_info+0x2e/0x50\n __kasan_slab_free+0x10e/0x1a0\n __kmem_cache_free+0x7a/0x1a0\n cifs_readdata_release+0x49/0x60\n process_one_work+0x46c/0x760\n worker_thread+0x2a4/0x6f0\n kthread+0x16b/0x1a0\n ret_from_fork+0x2c/0x50\n\n Last potentially related work creation:\n kasan_save_stack+0x22/0x50\n __kasan_record_aux_stack+0x95/0xb0\n insert_work+0x2b/0x130\n __queue_work+0x1fe/0x660\n queue_work_on+0x4b/0x60\n smb2_readv_callback+0x396/0x800\n cifs_abort_connection+0x474/0x6a0\n cifs_reconnect+0x5cb/0xa50\n cifs_readv_from_socket.cold+0x22/0x6c\n cifs_read_page_from_socket+0xc1/0x100\n readpages_fill_pages.cold+0x2f/0x46\n cifs_readv_receive+0x46d/0xa40\n cifs_demultiplex_thread+0x121c/0x1490\n kthread+0x16b/0x1a0\n ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n cifs_readv_from_socket\n cifs_reconnect\n __cifs_reconnect\n cifs_abort_connection\n mid->callback() --> smb2_readv_callback\n queue_work(&rdata->work) # if the worker completes first,\n # the rdata is freed\n cifs_readv_complete\n kref_put\n cifs_readdata_release\n kfree(rdata)\n return rdata->... # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52741" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0", "url": "https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e", "url": "https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211", "url": "https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9", "url": "https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9" } ], "release_date": "2024-05-21T15:23:03Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-21T15:23:03Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38572", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: reject malicious packets in ipv6_gso_segment()\n\nsyzbot was able to craft a packet with very long IPv6 extension headers\nleading to an overflow of skb->transport_header.\n\nThis 16bit field has a limited range.\n\nAdd skb_reset_transport_header_careful() helper and use it\nfrom ipv6_gso_segment()\n\nWARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]\nWARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151\nModules linked in:\nCPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\n RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]\n RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151\nCall Trace:\n \n skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53\n nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110\n skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53\n __skb_gso_segment+0x342/0x510 net/core/gso.c:124\n skb_gso_segment include/net/gso.h:83 [inline]\n validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950\n validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000\n sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329\n __dev_xmit_skb net/core/dev.c:4102 [inline]\n __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38572" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09ff062b89d8e48165247d677d1ca23d6d607e9b", "url": "https://git.kernel.org/stable/c/09ff062b89d8e48165247d677d1ca23d6d607e9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1", "url": "https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67", "url": "https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4e", "url": "https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5dc60b2a00ed7629214ac0c48e43f40af2078703", "url": "https://git.kernel.org/stable/c/5dc60b2a00ed7629214ac0c48e43f40af2078703" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887fe", "url": "https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67e", "url": "https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789", "url": "https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef05007b403dcc21e701cb1f30d4572ac0a9da20", "url": "https://git.kernel.org/stable/c/ef05007b403dcc21e701cb1f30d4572ac0a9da20" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-08-19T17:02:52Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-08-19T17:02:52Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38563", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Prevent VMA split of buffer mappings\n\nThe perf mmap code is careful about mmap()'ing the user page with the\nringbuffer and additionally the auxiliary buffer, when the event supports\nit. Once the first mapping is established, subsequent mapping have to use\nthe same offset and the same size in both cases. The reference counting for\nthe ringbuffer and the auxiliary buffer depends on this being correct.\n\nThough perf does not prevent that a related mapping is split via mmap(2),\nmunmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls,\nwhich take reference counts, but then the subsequent perf_mmap_close()\ncalls are not longer fulfilling the offset and size checks. This leads to\nreference count leaks.\n\nAs perf already has the requirement for subsequent mappings to match the\ninitial mapping, the obvious consequence is that VMA splits, caused by\nresizing of a mapping or partial unmapping, have to be prevented.\n\nImplement the vm_operations_struct::may_split() callback and return\nunconditionally -EINVAL.\n\nThat ensures that the mapping offsets and sizes cannot be changed after the\nfact. Remapping to a different fixed address with the same size is still\npossible as it takes the references for the new mapping and drops those of\nthe old mapping.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38563" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0", "url": "https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb", "url": "https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121", "url": "https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b", "url": "https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6", "url": "https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff", "url": "https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e", "url": "https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f", "url": "https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd", "url": "https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd" }, { "category": "external", "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-873/", "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-873/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-08-19T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-08-19T17:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53136", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why & How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086", "url": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a", "url": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b", "url": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c", "url": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117", "url": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60", "url": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a", "url": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T09:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39730", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39730" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40", "url": "https://git.kernel.org/stable/c/12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ad40b7992aa26bc631afc1a995b0e3ddc30de3f", "url": "https://git.kernel.org/stable/c/2ad40b7992aa26bc631afc1a995b0e3ddc30de3f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3570ef5c31314c13274c935a20b91768ab5bf412", "url": "https://git.kernel.org/stable/c/3570ef5c31314c13274c935a20b91768ab5bf412" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/763810bb883cb4de412a72f338d80947d97df67b", "url": "https://git.kernel.org/stable/c/763810bb883cb4de412a72f338d80947d97df67b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7dd36f7477d1e03a1fcf8d13531ca326c4fb599f", "url": "https://git.kernel.org/stable/c/7dd36f7477d1e03a1fcf8d13531ca326c4fb599f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f8eca87fef7519e9c41f3258f25ebc2752247ee", "url": "https://git.kernel.org/stable/c/7f8eca87fef7519e9c41f3258f25ebc2752247ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7f7866932466332a2528fda099000b035303485", "url": "https://git.kernel.org/stable/c/b7f7866932466332a2528fda099000b035303485" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb09afa0948d96b1e385d609ed044bb1aa043536", "url": "https://git.kernel.org/stable/c/cb09afa0948d96b1e385d609ed044bb1aa043536" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef93a685e01a281b5e2a25ce4e3428cf9371a205", "url": "https://git.kernel.org/stable/c/ef93a685e01a281b5e2a25ce4e3428cf9371a205" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-09-07T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-07T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-53090", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() can incur lock recursion. The problem is that it\nis called from AF_RXRPC whilst holding the ->notify_lock, but it tries to\ntake a ref on the afs_call struct in order to pass it to a work queue - but\nif the afs_call is already queued, we then have an extraneous ref that must\nbe put... calling afs_put_call() may call back down into AF_RXRPC through\nrxrpc_kernel_shutdown_call(), however, which might try taking the\n->notify_lock again.\n\nThis case isn't very common, however, so defer it to a workqueue. The oops\nlooks something like:\n\n BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646\n lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351\n Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\n Call Trace:\n \n dump_stack_lvl+0x47/0x70\n do_raw_spin_lock+0x3c/0x90\n rxrpc_kernel_shutdown_call+0x83/0xb0\n afs_put_call+0xd7/0x180\n rxrpc_notify_socket+0xa0/0x190\n rxrpc_input_split_jumbo+0x198/0x1d0\n rxrpc_input_data+0x14b/0x1e0\n ? rxrpc_input_call_packet+0xc2/0x1f0\n rxrpc_input_call_event+0xad/0x6b0\n rxrpc_input_packet_on_conn+0x1e1/0x210\n rxrpc_input_packet+0x3f2/0x4d0\n rxrpc_io_thread+0x243/0x410\n ? __pfx_rxrpc_io_thread+0x10/0x10\n kthread+0xcf/0xe0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x24/0x40\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n ", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-53090" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/610a79ffea02102899a1373fe226d949944a7ed6", "url": "https://git.kernel.org/stable/c/610a79ffea02102899a1373fe226d949944a7ed6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7cbf81df996b1eae2dee8deb6df08e2eba78661", "url": "https://git.kernel.org/stable/c/d7cbf81df996b1eae2dee8deb6df08e2eba78661" } ], "release_date": "2024-11-21T18:17:07Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-11-21T18:17:07Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-39689", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Also allocate and copy hash for reading of filter files\n\nCurrently the reader of set_ftrace_filter and set_ftrace_notrace just adds\nthe pointer to the global tracer hash to its iterator. Unlike the writer\nthat allocates a copy of the hash, the reader keeps the pointer to the\nfilter hashes. This is problematic because this pointer is static across\nfunction calls that release the locks that can update the global tracer\nhashes. This can cause UAF and similar bugs.\n\nAllocate and copy the hash for reading the filter files like it is done\nfor the writers. This not only fixes UAF bugs, but also makes the code a\nbit simpler as it doesn't have to differentiate when to free the\niterator's hash between writers and readers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39689" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12064e1880fc9202be75ff668205b1703d92f74f", "url": "https://git.kernel.org/stable/c/12064e1880fc9202be75ff668205b1703d92f74f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b114a3282ab1a12cb4618a8f45db5d7185e784a", "url": "https://git.kernel.org/stable/c/3b114a3282ab1a12cb4618a8f45db5d7185e784a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64db338140d2bad99a0a8c6a118dd60b3e1fb8cb", "url": "https://git.kernel.org/stable/c/64db338140d2bad99a0a8c6a118dd60b3e1fb8cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309", "url": "https://git.kernel.org/stable/c/a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bfb336cf97df7b37b2b2edec0f69773e06d11955", "url": "https://git.kernel.org/stable/c/bfb336cf97df7b37b2b2edec0f69773e06d11955" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4cd93811e038d19f961985735ef7bb128078dfb", "url": "https://git.kernel.org/stable/c/c4cd93811e038d19f961985735ef7bb128078dfb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c591ba1acd081d4980713e47869dd1cc3d963d19", "url": "https://git.kernel.org/stable/c/c591ba1acd081d4980713e47869dd1cc3d963d19" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0b6b223167e1edde5c82edf38e393c06eda1f13", "url": "https://git.kernel.org/stable/c/e0b6b223167e1edde5c82edf38e393c06eda1f13" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2025-09-05T17:20:55Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-05T17:20:55Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53432", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: fix use after free in fwnet_finish_incoming_packet()\n\nThe netif_rx() function frees the skb so we can't dereference it to\nsave the skb->len.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53432" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ea70379e4f4efa95c9daa7f3f9bdd4d40aec927", "url": "https://git.kernel.org/stable/c/2ea70379e4f4efa95c9daa7f3f9bdd4d40aec927" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ff256751a2853e1ffaa36958ff933ccc98c6cb5", "url": "https://git.kernel.org/stable/c/3ff256751a2853e1ffaa36958ff933ccc98c6cb5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9040adc38cf6bfbb77034d558ac2c52f70d840ac", "url": "https://git.kernel.org/stable/c/9040adc38cf6bfbb77034d558ac2c52f70d840ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9860921ab4521252dc39bb21b9c936bd09a00982", "url": "https://git.kernel.org/stable/c/9860921ab4521252dc39bb21b9c936bd09a00982" } ], "release_date": "2025-09-18T16:04:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-18T16:04:12Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31452", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)->i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31452" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a", "url": "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf", "url": "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949", "url": "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669", "url": "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6", "url": "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4", "url": "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17", "url": "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636", "url": "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-04-22T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-22T14:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39823", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: use array_index_nospec with indices that come from guest\n\nmin and dest_id are guest-controlled indices. Using array_index_nospec()\nafter the bounds checks clamps these values to mitigate speculative execution\nside-channels.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39823" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974", "url": "https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f", "url": "https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695", "url": "https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48", "url": "https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548", "url": "https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12", "url": "https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69", "url": "https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb", "url": "https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-16T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T13:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53091", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb->head.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb->data, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53091" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4", "url": "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a", "url": "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53091", "url": "https://access.redhat.com/security/cve/CVE-2026-53091" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492270" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json" } ], "release_date": "2026-06-24T16:30:30Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T16:30:30Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-45893", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix & Optimize table creation from possibly unaligned memory\n\nSource blob may come from userspace and might be unaligned.\nTry to optize the copying process by avoiding unaligned memory accesses.\n\n- Added Fixes tag\n- Added \"Fix &\" to description as this doesn't just optimize but fixes\n a potential unaligned memory access\n[jj: remove duplicate word \"convert\" in comment trigger checkpatch warning]", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-45893" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/226c3b10aab23f73b03c47e7773107de56ba3a4e", "url": "https://git.kernel.org/stable/c/226c3b10aab23f73b03c47e7773107de56ba3a4e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47e351dfef60ab0e3285133556e1a9c7f646a969", "url": "https://git.kernel.org/stable/c/47e351dfef60ab0e3285133556e1a9c7f646a969" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a", "url": "https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e027999049c493fb728ead5a90db76942181a935", "url": "https://git.kernel.org/stable/c/e027999049c493fb728ead5a90db76942181a935" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-27T14:17:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53254", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncacheinfo: Fix shared_cpu_map to handle shared caches at different levels\n\nThe cacheinfo sets up the shared_cpu_map by checking whether the caches\nwith the same index are shared between CPUs. However, this will trigger\nslab-out-of-bounds access if the CPUs do not have the same cache hierarchy.\nAnother problem is the mismatched shared_cpu_map when the shared cache does\nnot have the same index between CPUs.\n\nCPU0\tI\tD\tL3\nindex\t0\t1\t2\tx\n\t^\t^\t^\t^\nindex\t0\t1\t2\t3\nCPU1\tI\tD\tL2\tL3\n\nThis patch checks each cache is shared with all caches on other CPUs.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53254" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/198102c9103fc78d8478495971947af77edb05c1", "url": "https://git.kernel.org/stable/c/198102c9103fc78d8478495971947af77edb05c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f588d0345d69a35e451077afed428fd057a5e34", "url": "https://git.kernel.org/stable/c/2f588d0345d69a35e451077afed428fd057a5e34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dea49f2993f57d8a2df2cacb0bf649ef49b28879", "url": "https://git.kernel.org/stable/c/dea49f2993f57d8a2df2cacb0bf649ef49b28879" } ], "release_date": "2025-09-15T14:46:24Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-15T14:46:24Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53264", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() <-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() <-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held\n 1: idr_remove(idr, index) <-- Action removed from IDR\n 1: mutex_unlock() <-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet's illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0\n 1: rcu_read_unlock() <-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0's subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53264" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835", "url": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2", "url": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305", "url": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113", "url": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009", "url": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7", "url": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3", "url": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5", "url": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5" }, { "category": "external", "summary": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/", "url": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/" } ], "release_date": "2026-06-25T08:39:51Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:51Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50067", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobe: avoid out-of-bounds memory access of fetching args\n\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\nbuffer to avoid non-atomic context problem.\n\nSometimes user-space strings, arrays can be very large, but the size of\npercpu buffer is only page size. And store_trace_args() won't check\nwhether these data exceeds a single page or not, caused out-of-bounds\nmemory access.\n\nIt could be reproduced by following steps:\n1. build kernel with CONFIG_KASAN enabled\n2. save follow program as test.c\n\n```\n\\#include \n\\#include \n\\#include \n\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\n// will return 0, cause __get_data_size() return shorter size, and\n// store_trace_args() will not trigger out-of-bounds access.\n// So make string length less than 4096.\n\\#define STRLEN 4093\n\nvoid generate_string(char *str, int n)\n{\n int i;\n for (i = 0; i < n; ++i)\n {\n char c = i % 26 + 'a';\n str[i] = c;\n }\n str[n-1] = '\\0';\n}\n\nvoid print_string(char *str)\n{\n printf(\"%s\\n\", str);\n}\n\nint main()\n{\n char tmp[STRLEN];\n\n generate_string(tmp, STRLEN);\n print_string(tmp);\n\n return 0;\n}\n```\n3. compile program\n`gcc -o test test.c`\n\n4. get the offset of `print_string()`\n```\nobjdump -t test | grep -w print_string\n0000000000401199 g F .text 000000000000001b print_string\n```\n\n5. configure uprobe with offset 0x1199\n```\noff=0x1199\n\ncd /sys/kernel/debug/tracing/\necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\"\n > uprobe_events\necho 1 > events/uprobes/enable\necho 1 > tracing_on\n```\n\n6. run `test`, and kasan will report error.\n==================================================================\nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0\nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x55/0x70\n print_address_description.constprop.0+0x27/0x310\n kasan_report+0x10f/0x120\n ? strncpy_from_user+0x1d6/0x1f0\n strncpy_from_user+0x1d6/0x1f0\n ? rmqueue.constprop.0+0x70d/0x2ad0\n process_fetch_insn+0xb26/0x1470\n ? __pfx_process_fetch_insn+0x10/0x10\n ? _raw_spin_lock+0x85/0xe0\n ? __pfx__raw_spin_lock+0x10/0x10\n ? __pte_offset_map+0x1f/0x2d0\n ? unwind_next_frame+0xc5f/0x1f80\n ? arch_stack_walk+0x68/0xf0\n ? is_bpf_text_address+0x23/0x30\n ? kernel_text_address.part.0+0xbb/0xd0\n ? __kernel_text_address+0x66/0xb0\n ? unwind_get_return_address+0x5e/0xa0\n ? __pfx_stack_trace_consume_entry+0x10/0x10\n ? arch_stack_walk+0xa2/0xf0\n ? _raw_spin_lock_irqsave+0x8b/0xf0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? depot_alloc_stack+0x4c/0x1f0\n ? _raw_spin_unlock_irqrestore+0xe/0x30\n ? stack_depot_save_flags+0x35d/0x4f0\n ? kasan_save_stack+0x34/0x50\n ? kasan_save_stack+0x24/0x50\n ? mutex_lock+0x91/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n prepare_uprobe_buffer.part.0+0x2cd/0x500\n uprobe_dispatcher+0x2c3/0x6a0\n ? __pfx_uprobe_dispatcher+0x10/0x10\n ? __kasan_slab_alloc+0x4d/0x90\n handler_chain+0xdd/0x3e0\n handle_swbp+0x26e/0x3d0\n ? __pfx_handle_swbp+0x10/0x10\n ? uprobe_pre_sstep_notifier+0x151/0x1b0\n irqentry_exit_to_user_mode+0xe2/0x1b0\n asm_exc_int3+0x39/0x40\nRIP: 0033:0x401199\nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce\nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206\nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2\nRDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0\nRBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20\nR10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040\nR13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000\n \n\nThis commit enforces the buffer's maxlen less than a page-size to avoid\nstore_trace_args() out-of-memory access.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50067" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f", "url": "https://git.kernel.org/stable/c/0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/373b9338c9722a368925d83bc622c596896b328e", "url": "https://git.kernel.org/stable/c/373b9338c9722a368925d83bc622c596896b328e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/537ad4a431f6dddbf15d40d19f24bb9ee12b55cb", "url": "https://git.kernel.org/stable/c/537ad4a431f6dddbf15d40d19f24bb9ee12b55cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e5f93788c9dd4309e75a56860a1ac44a8e117b9", "url": "https://git.kernel.org/stable/c/9e5f93788c9dd4309e75a56860a1ac44a8e117b9" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-10-28T00:57:05Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-10-28T00:57:05Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53333", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one\n\nEric Dumazet says:\n nf_conntrack_dccp_packet() has an unique:\n\n dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);\n\n And nothing more is 'pulled' from the packet, depending on the content.\n dh->dccph_doff, and/or dh->dccph_x ...)\n So dccp_ack_seq() is happily reading stuff past the _dh buffer.\n\nBUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0\nRead of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371\n[..]\n\nFix this by increasing the stack buffer to also include room for\nthe extra sequence numbers and all the known dccp packet type headers,\nthen pull again after the initial validation of the basic header.\n\nWhile at it, mark packets invalid that lack 48bit sequence bit but\nwhere RFC says the type MUST use them.\n\nCompile tested only.\n\nv2: first skb_header_pointer() now needs to adjust the size to\n only pull the generic header. (Eric)\n\nHeads-up: I intend to remove dccp conntrack support later this year.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53333" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26bd1f210d3783a691052c51d76bb8a8bbd24c67", "url": "https://git.kernel.org/stable/c/26bd1f210d3783a691052c51d76bb8a8bbd24c67" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/337fdce450637ea663bc816edc2ba81e5cdad02e", "url": "https://git.kernel.org/stable/c/337fdce450637ea663bc816edc2ba81e5cdad02e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5c618daa5038712c4a4ef8923905a2ea1b8836a1", "url": "https://git.kernel.org/stable/c/5c618daa5038712c4a4ef8923905a2ea1b8836a1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c0980493beed3a80d6329c44ab293dc8c032927", "url": "https://git.kernel.org/stable/c/8c0980493beed3a80d6329c44ab293dc8c032927" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8", "url": "https://git.kernel.org/stable/c/9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c052797ac36813419ad3bfa54cb8615db4b41f15", "url": "https://git.kernel.org/stable/c/c052797ac36813419ad3bfa54cb8615db4b41f15" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30", "url": "https://git.kernel.org/stable/c/ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30" } ], "release_date": "2025-09-16T16:12:08Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T16:12:08Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53009", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double-free of tx_buf skb\n\nIf ice_tso() or ice_tx_csum() fail, the error path in\nice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points\nto it and is marked as valid (ICE_TX_BUF_SKB).\n'next_to_use' remains unchanged, so the potential problem will\nlikely fix itself when the next packet is transmitted and the tx_buf\ngets overwritten. But if there is no next packet and the interface is\nbrought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf()\nwill find the tx_buf and free the skb for the second time.\n\nThe fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error\npath, so that ice_unmap_and_free_tx_buf().\nMove the initialization of 'first' up, to ensure it's already valid in\ncase we hit the linearization error path.\n\nThe bug was spotted by AI while I had it looking for something else.\nIt also proposed an initial version of the patch.\n\nI reproduced the bug and tested the fix by adding code to inject\nfailures, on a build with KASAN.\n\nI looked for similar bugs in related Intel drivers and did not find any.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd", "url": "https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2", "url": "https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:42919", "url": "https://access.redhat.com/errata/RHSA-2026:42919" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54246", "url": "https://access.redhat.com/errata/RHSA-2026:54246" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54247", "url": "https://access.redhat.com/errata/RHSA-2026:54247" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53009", "url": "https://access.redhat.com/security/cve/CVE-2026-53009" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492390", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492390" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T17:17:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-35932", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: don't check if plane->state->fb == state->fb\n\nCurrently, when using non-blocking commits, we can see the following\nkernel warning:\n\n[ 110.908514] ------------[ cut here ]------------\n[ 110.908529] refcount_t: underflow; use-after-free.\n[ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0\n[ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6\n[ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32\n[ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)\n[ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0\n[ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0\n[ 110.909170] sp : ffffffc00913b9c0\n[ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60\n[ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480\n[ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78\n[ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000\n[ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004\n[ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003\n[ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00\n[ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572\n[ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000\n[ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001\n[ 110.909434] Call trace:\n[ 110.909441] refcount_dec_not_one+0xb8/0xc0\n[ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4]\n[ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4]\n[ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper]\n[ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4]\n[ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper]\n[ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper]\n[ 110.911716] drm_atomic_commit+0xb0/0xdc [drm]\n[ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm]\n[ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm]\n[ 110.914091] drm_ioctl+0x24c/0x3b0 [drm]\n[ 110.914850] __arm64_sys_ioctl+0x9c/0xd4\n[ 110.914873] invoke_syscall+0x4c/0x114\n[ 110.914897] el0_svc_common+0xd0/0x118\n[ 110.914917] do_el0_svc+0x38/0xd0\n[ 110.914936] el0_svc+0x30/0x8c\n[ 110.914958] el0t_64_sync_handler+0x84/0xf0\n[ 110.914979] el0t_64_sync+0x18c/0x190\n[ 110.914996] ---[ end trace 0000000000000000 ]---\n\nThis happens because, although `prepare_fb` and `cleanup_fb` are\nperfectly balanced, we cannot guarantee consistency in the check\nplane->state->fb == state->fb. This means that sometimes we can increase\nthe refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The\nopposite can also be true.\n\nIn fact, the struct drm_plane .state shouldn't be accessed directly\nbut instead, the `drm_atomic_get_new_plane_state()` helper function should\nbe used. So, we could stick to this check, but using\n`drm_atomic_get_new_plane_state()`. But actually, this check is not re\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-35932" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48bfb4b03c5ff6e1fa1dc73fb915e150b0968c40", "url": "https://git.kernel.org/stable/c/48bfb4b03c5ff6e1fa1dc73fb915e150b0968c40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5343f724c912c77541029123f47ecd3d2ea63bdd", "url": "https://git.kernel.org/stable/c/5343f724c912c77541029123f47ecd3d2ea63bdd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9", "url": "https://git.kernel.org/stable/c/5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d6b2fe2db1d0927b2d7df5c763eba55d0e1def3c", "url": "https://git.kernel.org/stable/c/d6b2fe2db1d0927b2d7df5c763eba55d0e1def3c" } ], "release_date": "2024-05-19T10:10:40Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-19T10:10:40Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-23158", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add check to handle incorrect queue size\n\nqsize represents size of shared queued between driver and video\nfirmware. Firmware can modify this value to an invalid large value. In\nsuch situation, empty_space will be bigger than the space actually\navailable. Since new_wr_idx is not checked, so the following code will\nresult in an OOB write.\n...\nqsize = qhdr->q_size\n\nif (wr_idx >= rd_idx)\n empty_space = qsize - (wr_idx - rd_idx)\n....\nif (new_wr_idx < qsize) {\n memcpy(wr_ptr, packet, dwords << 2) --> OOB write\n\nAdd check to ensure qsize is within the allocated size while\nreading and writing packets into the queue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-23158" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86", "url": "https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d", "url": "https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4", "url": "https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54", "url": "https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096", "url": "https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1", "url": "https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f", "url": "https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75", "url": "https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96", "url": "https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-01T12:55:43Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-01T12:55:43Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43427", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc->length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43427" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b", "url": "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934", "url": "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0", "url": "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91", "url": "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a", "url": "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173", "url": "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360", "url": "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea", "url": "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea" } ], "release_date": "2026-05-08T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-08T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39911", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path\n\nIf request_irq() in i40e_vsi_request_irq_msix() fails in an iteration\nlater than the first, the error path wants to free the IRQs requested\nso far. However, it uses the wrong dev_id argument for free_irq(), so\nit does not free the IRQs correctly and instead triggers the warning:\n\n Trying to free already-free IRQ 173\n WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0\n Modules linked in: i40e(+) [...]\n CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy)\n Hardware name: [...]\n RIP: 0010:__free_irq+0x192/0x2c0\n [...]\n Call Trace:\n \n free_irq+0x32/0x70\n i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e]\n i40e_vsi_request_irq+0x79/0x80 [i40e]\n i40e_vsi_open+0x21f/0x2f0 [i40e]\n i40e_open+0x63/0x130 [i40e]\n __dev_open+0xfc/0x210\n __dev_change_flags+0x1fc/0x240\n netif_change_flags+0x27/0x70\n do_setlink.isra.0+0x341/0xc70\n rtnl_newlink+0x468/0x860\n rtnetlink_rcv_msg+0x375/0x450\n netlink_rcv_skb+0x5c/0x110\n netlink_unicast+0x288/0x3c0\n netlink_sendmsg+0x20d/0x430\n ____sys_sendmsg+0x3a2/0x3d0\n ___sys_sendmsg+0x99/0xe0\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x82/0x2c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n \n ---[ end trace 0000000000000000 ]---\n\nUse the same dev_id for free_irq() as for request_irq().\n\nI tested this with inserting code to fail intentionally.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39911" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13ab9adef3cd386511c930a9660ae06595007f89", "url": "https://git.kernel.org/stable/c/13ab9adef3cd386511c930a9660ae06595007f89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23431998a37764c464737b855c71a81d50992e98", "url": "https://git.kernel.org/stable/c/23431998a37764c464737b855c71a81d50992e98" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e4016c0dca53afc71e3b99e24252b63417395df", "url": "https://git.kernel.org/stable/c/6e4016c0dca53afc71e3b99e24252b63417395df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/915470e1b44e71d1dd07ee067276f003c3521ee3", "url": "https://git.kernel.org/stable/c/915470e1b44e71d1dd07ee067276f003c3521ee3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a30afd6617c30aaa338d1dbcb1e34e7a1890085c", "url": "https://git.kernel.org/stable/c/a30afd6617c30aaa338d1dbcb1e34e7a1890085c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b905b2acb3a0bbb08ad9be9984d8cdabdf827315", "url": "https://git.kernel.org/stable/c/b905b2acb3a0bbb08ad9be9984d8cdabdf827315" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9721a023df38cf44a88f2739b4cf51efd051f85", "url": "https://git.kernel.org/stable/c/b9721a023df38cf44a88f2739b4cf51efd051f85" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c62580674ce5feb1be4f90b5873ff3ce50e0a1db", "url": "https://git.kernel.org/stable/c/c62580674ce5feb1be4f90b5873ff3ce50e0a1db" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-10-01T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-01T08:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43075", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device. The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free. The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data. On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n vfs_copy_file_range (fs/read_write.c:1634)\n do_splice_direct\n splice_direct_to_actor\n iter_file_splice_write\n ocfs2_file_write_iter\n generic_perform_write\n ocfs2_write_end\n ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n memcpy_from_folio <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43075" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9", "url": "https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6", "url": "https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e", "url": "https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea", "url": "https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604", "url": "https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14", "url": "https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9", "url": "https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f", "url": "https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f" } ], "release_date": "2026-05-06T07:40:03Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T07:40:03Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47101", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nasix: fix uninit-value in asix_mdio_read()\n\nasix_read_cmd() may read less than sizeof(smsr) bytes and in this case\nsmsr will be uninitialized.\n\nFail log:\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\nBUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\n asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47101" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8035b1a2a37a29d8c717ef84fca8fe7278bc9f03", "url": "https://git.kernel.org/stable/c/8035b1a2a37a29d8c717ef84fca8fe7278bc9f03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d259f621c85949f30cc578cac813b82bb5169f56", "url": "https://git.kernel.org/stable/c/d259f621c85949f30cc578cac813b82bb5169f56" } ], "release_date": "2024-03-04T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-03-04T18:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31626", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()\n\nInitialize le_tmp64 to zero in rtw_BIP_verify() to prevent using\nuninitialized data.\n\nSmatch warns that only 6 bytes are copied to this 8-byte (u64)\nvariable, leaving the last two bytes uninitialized:\n\ndrivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()\nwarn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes)\n\nInitializing the variable at the start of the function fixes this\nwarning and ensures predictable behavior.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31626" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739", "url": "https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930", "url": "https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57", "url": "https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5b", "url": "https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8a", "url": "https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accf", "url": "https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9", "url": "https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732", "url": "https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efc", "url": "https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efc" } ], "release_date": "2026-04-24T14:42:47Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:47Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-58072", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: remove unused check_buddy_priv\n\nCommit 2461c7d60f9f (\"rtlwifi: Update header file\") introduced a global\nlist of private data structures.\n\nLater on, commit 26634c4b1868 (\"rtlwifi Modify existing bits to match\nvendor version 2013.02.07\") started adding the private data to that list at\nprobe time and added a hook, check_buddy_priv to find the private data from\na similar device.\n\nHowever, that function was never used.\n\nBesides, though there is a lock for that list, it is never used. And when\nthe probe fails, the private data is never removed from the list. This\nwould cause a second probe to access freed memory.\n\nRemove the unused hook, structures and members, which will prevent the\npotential race condition on the list and its corruption during a second\nprobe when probe fails.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-58072" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/006e803af7408c3fc815b0654fc5ab43d34f0154", "url": "https://git.kernel.org/stable/c/006e803af7408c3fc815b0654fc5ab43d34f0154" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b9cbd8a9ae68b32099fbb03b2d5ffa0c5e0dcc9", "url": "https://git.kernel.org/stable/c/1b9cbd8a9ae68b32099fbb03b2d5ffa0c5e0dcc9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e39b0486cdb496cdfba3bc89886150e46acf6f4", "url": "https://git.kernel.org/stable/c/1e39b0486cdb496cdfba3bc89886150e46acf6f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fdac64c3c35858aa8ac5caa70b232e03456e120", "url": "https://git.kernel.org/stable/c/2fdac64c3c35858aa8ac5caa70b232e03456e120" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/465d01ef6962b82b1f0ad1f3e58b398dbd35c1c1", "url": "https://git.kernel.org/stable/c/465d01ef6962b82b1f0ad1f3e58b398dbd35c1c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/543e3e9f2e9e47ded774c74e680f28a0ca362aee", "url": "https://git.kernel.org/stable/c/543e3e9f2e9e47ded774c74e680f28a0ca362aee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e2fcc68fbaab3ad9f5671fee2be0956134b740a", "url": "https://git.kernel.org/stable/c/8e2fcc68fbaab3ad9f5671fee2be0956134b740a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f801e754efa21bd61b3cc15ec7565696165b272f", "url": "https://git.kernel.org/stable/c/f801e754efa21bd61b3cc15ec7565696165b272f" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2025-03-06T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-03-06T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-21749", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: lock the socket in rose_bind()\n\nsyzbot reported a soft lockup in rose_loopback_timer(),\nwith a repro calling bind() from multiple threads.\n\nrose_bind() must lock the socket to avoid this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-21749" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c04b0ab3a647e76d0e752b013de8e404abafc63", "url": "https://git.kernel.org/stable/c/4c04b0ab3a647e76d0e752b013de8e404abafc63" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/667f61b3498df751c8b3f0be1637e7226cbe3ed0", "url": "https://git.kernel.org/stable/c/667f61b3498df751c8b3f0be1637e7226cbe3ed0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/970cd2ed26cdab2b0f15b6d90d7eaa36538244a5", "url": "https://git.kernel.org/stable/c/970cd2ed26cdab2b0f15b6d90d7eaa36538244a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a1300691aed9ee852b0a9192e29e2bdc2411a7e6", "url": "https://git.kernel.org/stable/c/a1300691aed9ee852b0a9192e29e2bdc2411a7e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8bf5c3fb778bbb1f3ff7d98ec577c969f687513", "url": "https://git.kernel.org/stable/c/b8bf5c3fb778bbb1f3ff7d98ec577c969f687513" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d308661a0f4e7c8e86dfc7074a55ee5894c61538", "url": "https://git.kernel.org/stable/c/d308661a0f4e7c8e86dfc7074a55ee5894c61538" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0384efd45f615603e6869205b72040c209e69cc", "url": "https://git.kernel.org/stable/c/e0384efd45f615603e6869205b72040c209e69cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed00c5f907d08a647b8bf987514ad8c6b17971a7", "url": "https://git.kernel.org/stable/c/ed00c5f907d08a647b8bf987514ad8c6b17971a7" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "release_date": "2025-02-27T03:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-02-27T03:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-23089", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\n\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\nmixer->id_elems but the controls already added to the card still\nreference the freed memory. Later when snd_card_register() runs,\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\n\nCall trace:\n get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\n get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\n mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\n snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\n ...\n snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\n usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\n\nFix by calling snd_ctl_remove() for all mixer controls before freeing\nid_elems. We save the next pointer first because snd_ctl_remove()\nfrees the current element.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23089" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea", "url": "https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6", "url": "https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af", "url": "https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a", "url": "https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2", "url": "https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad", "url": "https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963", "url": "https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963" } ], "release_date": "2026-02-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-71082", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(&btusb_driver, data->intf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71082" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339", "url": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880", "url": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b", "url": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc", "url": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003", "url": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1", "url": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1" } ], "release_date": "2026-01-13T15:34:46Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-13T15:34:46Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38728", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix for slab out of bounds on mount to ksmbd\n\nWith KASAN enabled, it is possible to get a slab out of bounds\nduring mount to ksmbd due to missing check in parse_server_interfaces()\n(see below):\n\n BUG: KASAN: slab-out-of-bounds in\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount/9827\n\n CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G\n OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary)\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,\n BIOS 2.13.1 06/14/2019\n Call Trace:\n \n dump_stack_lvl+0x9f/0xf0\n print_report+0xd1/0x670\n __virt_addr_valid+0x22c/0x430\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a/0x1f0\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n kasan_report+0xd6/0x110\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n __asan_report_load_n_noabort+0x13/0x20\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]\n ? trace_hardirqs_on+0x51/0x60\n SMB3_request_interfaces+0x1ad/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]\n ? SMB2_tcon+0x23c/0x15d0 [cifs]\n smb3_qfs_tcon+0x173/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n cifs_mount_get_tcon+0x369/0xb90 [cifs]\n ? dfs_cache_find+0xe7/0x150 [cifs]\n dfs_mount_share+0x985/0x2970 [cifs]\n ? check_path.constprop.0+0x28/0x50\n ? save_trace+0x54/0x370\n ? __pfx_dfs_mount_share+0x10/0x10 [cifs]\n ? __lock_acquire+0xb82/0x2ba0\n ? __kasan_check_write+0x18/0x20\n cifs_mount+0xbc/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]\n cifs_smb3_do_mount+0x263/0x1990 [cifs]", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38728" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc", "url": "https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6", "url": "https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565", "url": "https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0", "url": "https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463", "url": "https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac", "url": "https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-04T15:33:26Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-04T15:33:26Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39901", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: remove read access to debugfs files\n\nThe 'command' and 'netdev_ops' debugfs files are a legacy debugging\ninterface supported by the i40e driver since its early days by commit\n02e9c290814c (\"i40e: debugfs interface\").\n\nBoth of these debugfs files provide a read handler which is mostly useless,\nand which is implemented with questionable logic. They both use a static\n256 byte buffer which is initialized to the empty string. In the case of\nthe 'command' file this buffer is literally never used and simply wastes\nspace. In the case of the 'netdev_ops' file, the last command written is\nsaved here.\n\nOn read, the files contents are presented as the name of the device\nfollowed by a colon and then the contents of their respective static\nbuffer. For 'command' this will always be \": \". For 'netdev_ops',\nthis will be \": \". But note the buffer is\nshared between all devices operated by this module. At best, it is mostly\nmeaningless information, and at worse it could be accessed simultaneously\nas there doesn't appear to be any locking mechanism.\n\nWe have also recently received multiple reports for both read functions\nabout their use of snprintf and potential overflow that could result in\nreading arbitrary kernel memory. For the 'command' file, this is definitely\nimpossible, since the static buffer is always zero and never written to.\nFor the 'netdev_ops' file, it does appear to be possible, if the user\ncarefully crafts the command input, it will be copied into the buffer,\nwhich could be large enough to cause snprintf to truncate, which then\ncauses the copy_to_user to read beyond the length of the buffer allocated\nby kzalloc.\n\nA minimal fix would be to replace snprintf() with scnprintf() which would\ncap the return to the number of bytes written, preventing an overflow. A\nmore involved fix would be to drop the mostly useless static buffers,\nsaving 512 bytes and modifying the read functions to stop needing those as\ninput.\n\nInstead, lets just completely drop the read access to these files. These\nare debug interfaces exposed as part of debugfs, and I don't believe that\ndropping read access will break any script, as the provided output is\npretty useless. You can find the netdev name through other more standard\ninterfaces, and the 'netdev_ops' interface can easily result in garbage if\nyou issue simultaneous writes to multiple devices at once.\n\nIn order to properly remove the i40e_dbg_netdev_ops_buf, we need to\nrefactor its write function to avoid using the static buffer. Instead, use\nthe same logic as the i40e_dbg_command_write, with an allocated buffer.\nUpdate the code to use this instead of the static buffer, and ensure we\nfree the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on\nmultiple devices, and allows us to remove the now unused static buffer\nalong with removing the read access.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39901" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fd8b30a5cb84d74015bc651799d1ab1e047946c", "url": "https://git.kernel.org/stable/c/6fd8b30a5cb84d74015bc651799d1ab1e047946c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/70d3dad7d5ad077965d7a63eed1942b7ba49bfb4", "url": "https://git.kernel.org/stable/c/70d3dad7d5ad077965d7a63eed1942b7ba49bfb4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d190963b80f4cd99d7008615600aa7cc993c6ba", "url": "https://git.kernel.org/stable/c/7d190963b80f4cd99d7008615600aa7cc993c6ba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fcdb1c3c4ba134434694c001dbff343f1ffa319", "url": "https://git.kernel.org/stable/c/9fcdb1c3c4ba134434694c001dbff343f1ffa319" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef40d9411469306e524e7887c51b709377e6ef65", "url": "https://git.kernel.org/stable/c/ef40d9411469306e524e7887c51b709377e6ef65" } ], "release_date": "2025-10-01T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-01T08:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56658", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: defer final 'struct net' free in netns dismantle\n\nIlya reported a slab-use-after-free in dst_destroy [1]\n\nIssue is in xfrm6_net_init() and xfrm4_net_init() :\n\nThey copy xfrm[46]_dst_ops_template into net->xfrm.xfrm[46]_dst_ops.\n\nBut net structure might be freed before all the dst callbacks are\ncalled. So when dst_destroy() calls later :\n\nif (dst->ops->destroy)\n dst->ops->destroy(dst);\n\ndst->ops points to the old net->xfrm.xfrm[46]_dst_ops, which has been freed.\n\nSee a relevant issue fixed in :\n\nac888d58869b (\"net: do not delay dst_entries_add() in dst_release()\")\n\nA fix is to queue the 'struct net' to be freed after one\nanother cleanup_net() round (and existing rcu_barrier())\n\n[1]\n\nBUG: KASAN: slab-use-after-free in dst_destroy (net/core/dst.c:112)\nRead of size 8 at addr ffff8882137ccab0 by task swapper/37/0\nDec 03 05:46:18 kernel:\nCPU: 37 UID: 0 PID: 0 Comm: swapper/37 Kdump: loaded Not tainted 6.12.0 #67\nHardware name: Red Hat KVM/RHEL, BIOS 1.16.1-1.el9 04/01/2014\nCall Trace:\n \ndump_stack_lvl (lib/dump_stack.c:124)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\n? dst_destroy (net/core/dst.c:112)\nprint_report (mm/kasan/report.c:489)\n? dst_destroy (net/core/dst.c:112)\n? kasan_addr_to_slab (mm/kasan/common.c:37)\nkasan_report (mm/kasan/report.c:603)\n? dst_destroy (net/core/dst.c:112)\n? rcu_do_batch (kernel/rcu/tree.c:2567)\ndst_destroy (net/core/dst.c:112)\nrcu_do_batch (kernel/rcu/tree.c:2567)\n? __pfx_rcu_do_batch (kernel/rcu/tree.c:2491)\n? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406)\nrcu_core (kernel/rcu/tree.c:2825)\nhandle_softirqs (kernel/softirq.c:554)\n__irq_exit_rcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637)\nirq_exit_rcu (kernel/softirq.c:651)\nsysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049)\n \n \nasm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702)\nRIP: 0010:default_idle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:743)\nCode: 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d c7 c9 27 00 fb f4 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90\nRSP: 0018:ffff888100d2fe00 EFLAGS: 00000246\nRAX: 00000000001870ed RBX: 1ffff110201a5fc2 RCX: ffffffffb61a3e46\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb3d4d123\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed11c7e1835d\nR10: ffff888e3f0c1aeb R11: 0000000000000000 R12: 0000000000000000\nR13: ffff888100d20000 R14: dffffc0000000000 R15: 0000000000000000\n? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:148)\n? cpuidle_idle_call (kernel/sched/idle.c:186)\ndefault_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118)\ncpuidle_idle_call (kernel/sched/idle.c:186)\n? __pfx_cpuidle_idle_call (kernel/sched/idle.c:168)\n? lock_release (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5848)\n? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)\n? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:59)\ndo_idle (kernel/sched/idle.c:326)\ncpu_startup_entry (kernel/sched/idle.c:423 (discriminator 1))\nstart_secondary (arch/x86/kernel/smpboot.c:202 arch/x86/kernel/smpboot.c:282)\n? __pfx_start_secondary (arch/x86/kernel/smpboot.c:232)\n? soft_restart_cpu (arch/x86/kernel/head_64.S:452)\ncommon_startup_64 (arch/x86/kernel/head_64.S:414)\n \nDec 03 05:46:18 kernel:\nAllocated by task 12184:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69)\n__kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345)\nkmem_cache_alloc_noprof (mm/slub.c:4085 mm/slub.c:4134 mm/slub.c:4141)\ncopy_net_ns (net/core/net_namespace.c:421 net/core/net_namespace.c:480)\ncreate_new_namespaces\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56658" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f6ede9fbc747e2553612271bce108f7517e7a45", "url": "https://git.kernel.org/stable/c/0f6ede9fbc747e2553612271bce108f7517e7a45" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3267b254dc0a04dfa362a2be24573cfa6d2d78f5", "url": "https://git.kernel.org/stable/c/3267b254dc0a04dfa362a2be24573cfa6d2d78f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6610c7f8a8d47fd1123eed55ba8c11c2444d8842", "url": "https://git.kernel.org/stable/c/6610c7f8a8d47fd1123eed55ba8c11c2444d8842" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7a79e51297f7b82adb687086f5cb2da446f1e40", "url": "https://git.kernel.org/stable/c/b7a79e51297f7b82adb687086f5cb2da446f1e40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c261dcd61c9e88a8f1a66654354d32295a975230", "url": "https://git.kernel.org/stable/c/c261dcd61c9e88a8f1a66654354d32295a975230" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dac465986a4a38cd2f13e934f562b6ca344e5720", "url": "https://git.kernel.org/stable/c/dac465986a4a38cd2f13e934f562b6ca344e5720" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "release_date": "2024-12-27T15:06:21Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T15:06:21Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64571", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate RX frame length in p54_rx_eeprom_readback()\n\np54_rx_eeprom_readback() copies the requested EEPROM slice out of a\ndevice-supplied readback frame without checking that the skb actually holds\nthat many bytes. Commit da1b9a55ff11 (\"wifi: p54: prevent buffer-overflow in\np54_rx_eeprom_readback()\") closed the destination overflow by copying a\nfixed priv->eeprom_slice_size (and rejecting a mismatched advertised len),\nbut the source side is still unbounded: nothing verifies the frame is long\nenough to supply that many bytes.\n\nA malicious USB device can send a short frame whose advertised len matches\npriv->eeprom_slice_size while the payload is truncated. The equality check\npasses and memcpy() reads past the end of the skb, leaking adjacent heap:\n\n BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)\n Read of size 1016 at addr ffff88800f077114 by task swapper/0/0\n Call Trace:\n \n ...\n __asan_memcpy (mm/kasan/shadow.c:105)\n p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)\n p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005)\n ...\n \n\n The buggy address belongs to the object at ffff88800f0770c0\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 84 bytes inside of\n allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)\n\nCheck that the slice fits in the skb before copying.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64571" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25c3b85af3fc4f8043159b14e65790fc3bbdaf48", "url": "https://git.kernel.org/stable/c/25c3b85af3fc4f8043159b14e65790fc3bbdaf48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a456ffcd20bd92ad0ef46c1aaa0e39e3be1f7e7", "url": "https://git.kernel.org/stable/c/7a456ffcd20bd92ad0ef46c1aaa0e39e3be1f7e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/88f7044f92b8326fbfab26d0d8ed297c367ebb76", "url": "https://git.kernel.org/stable/c/88f7044f92b8326fbfab26d0d8ed297c367ebb76" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9096e1f7014174067239a63df18ae5f28301990d", "url": "https://git.kernel.org/stable/c/9096e1f7014174067239a63df18ae5f28301990d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d38f5d868a0a4770e3bcd0925e16c46acdbc9509", "url": "https://git.kernel.org/stable/c/d38f5d868a0a4770e3bcd0925e16c46acdbc9509" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebd6d37fa94bee929e0b4c9ca19fdf9b1dcf6cea", "url": "https://git.kernel.org/stable/c/ebd6d37fa94bee929e0b4c9ca19fdf9b1dcf6cea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f21b7e096fe5371bf697cd410537fb434a763f5e", "url": "https://git.kernel.org/stable/c/f21b7e096fe5371bf697cd410537fb434a763f5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f46f8f9c43fd02f4dd5f716d4bda296a523c04f0", "url": "https://git.kernel.org/stable/c/f46f8f9c43fd02f4dd5f716d4bda296a523c04f0" } ], "release_date": "2026-08-05T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-05T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-71075", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aic94xx: fix use-after-free in device removal path\n\nThe asd_pci_remove() function fails to synchronize with pending tasklets\nbefore freeing the asd_ha structure, leading to a potential\nuse-after-free vulnerability.\n\nWhen a device removal is triggered (via hot-unplug or module unload),\nrace condition can occur.\n\nThe fix adds tasklet_kill() before freeing the asd_ha structure,\nensuring all scheduled tasklets complete before cleanup proceeds.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71075" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/278455a82245a572aeb218a6212a416a98e418de", "url": "https://git.kernel.org/stable/c/278455a82245a572aeb218a6212a416a98e418de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/751c19635c2bfaaf2836a533caa3663633066dcf", "url": "https://git.kernel.org/stable/c/751c19635c2bfaaf2836a533caa3663633066dcf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a41dc180b6e1229ae49ca290ae14d82101c148c3", "url": "https://git.kernel.org/stable/c/a41dc180b6e1229ae49ca290ae14d82101c148c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3e655e52b98a1d3df41c8e42035711e083099f8", "url": "https://git.kernel.org/stable/c/b3e655e52b98a1d3df41c8e42035711e083099f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8f6f88cd1df35155258285c4f43268b361819df", "url": "https://git.kernel.org/stable/c/c8f6f88cd1df35155258285c4f43268b361819df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e354793a7ab9bb0934ea699a9d57bcd1b48fc27b", "url": "https://git.kernel.org/stable/c/e354793a7ab9bb0934ea699a9d57bcd1b48fc27b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6ab594672d4cba08540919a4e6be2e202b60007", "url": "https://git.kernel.org/stable/c/f6ab594672d4cba08540919a4e6be2e202b60007" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2026-01-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-13T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31627", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31627" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7", "url": "https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416", "url": "https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d", "url": "https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6", "url": "https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b", "url": "https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a", "url": "https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb", "url": "https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197", "url": "https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da", "url": "https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da" } ], "release_date": "2026-04-24T14:42:48Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:48Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-35791", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()\n\nDo the cache flush of converted pages in svm_register_enc_region() before\ndropping kvm->lock to fix use-after-free issues where region and/or its\narray of pages could be freed by a different task, e.g. if userspace has\n__unregister_enc_region_locked() already queued up for the region.\n\nNote, the \"obvious\" alternative of using local variables doesn't fully\nresolve the bug, as region->pages is also dynamically allocated. I.e. the\nregion structure itself would be fine, but region->pages could be freed.\n\nFlushing multiple pages under kvm->lock is unfortunate, but the entire\nflow is a rare slow path, and the manual flush is only needed on CPUs that\nlack coherency for encrypted memory.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-35791" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4", "url": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d", "url": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865", "url": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807", "url": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7", "url": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a", "url": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "release_date": "2024-05-17T12:24:49Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-17T12:24:49Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50129", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix a use-after-free\n\nChange the LIO port members inside struct srpt_port from regular members\ninto pointers. Allocate the LIO port data structures from inside\nsrpt_make_tport() and free these from inside srpt_make_tport(). Keep\nstruct srpt_device as long as either an RDMA port or a LIO target port is\nassociated with it. This patch decouples the lifetime of struct srpt_port\n(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).\nThis patch fixes the following KASAN complaint:\n\n BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]\n Read of size 8 at addr ffff888141cc34b8 by task check/5093\n\n Call Trace:\n \n show_stack+0x4e/0x53\n dump_stack_lvl+0x51/0x66\n print_address_description.constprop.0.cold+0xea/0x41e\n print_report.cold+0x90/0x205\n kasan_report+0xb9/0xf0\n __asan_load8+0x69/0x90\n srpt_enable_tpg+0x31/0x70 [ib_srpt]\n target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]\n configfs_write_iter+0x18b/0x210\n new_sync_write+0x1f2/0x2f0\n vfs_write+0x3e3/0x540\n ksys_write+0xbb/0x140\n __x64_sys_write+0x42/0x50\n do_syscall_64+0x34/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n ", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50129" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04b", "url": "https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ee8c39968a648d58b273582d4b021044a41ee5e", "url": "https://git.kernel.org/stable/c/4ee8c39968a648d58b273582d4b021044a41ee5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5605148e6ce36bb21020d49010b617693933128", "url": "https://git.kernel.org/stable/c/b5605148e6ce36bb21020d49010b617693933128" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de95b52d9aabc979166aba81ccbe623aaf9c16a1", "url": "https://git.kernel.org/stable/c/de95b52d9aabc979166aba81ccbe623aaf9c16a1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e60d7e2462bf57273563c4e00dbfa79ee973b9e2", "url": "https://git.kernel.org/stable/c/e60d7e2462bf57273563c4e00dbfa79ee973b9e2" } ], "release_date": "2025-06-18T11:02:55Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T11:02:55Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53246", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53246" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b", "url": "https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e", "url": "https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a", "url": "https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a" } ], "release_date": "2026-06-25T08:39:39Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:39Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53189", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: update file PMD counter before folio_put()\n\n__split_huge_pmd_locked() updates the file/shmem RSS counter after\ndropping the PMD mapping's folio reference. If folio_put() drops the last\nreference, mm_counter_file() can later read freed folio state via\nfolio_test_swapbacked().\n\nMove the counter update before folio_put().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53189" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877", "url": "https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59", "url": "https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad", "url": "https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce", "url": "https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9", "url": "https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8", "url": "https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194", "url": "https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed5b030931292c94133437ac5e5ff580e498eabd", "url": "https://git.kernel.org/stable/c/ed5b030931292c94133437ac5e5ff580e498eabd" } ], "release_date": "2026-06-25T08:39:01Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:01Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50103", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed\n\nWith cgroup v2, the cpuset's cpus_allowed mask can be empty indicating\nthat the cpuset will just use the effective CPUs of its parent. So\ncpuset_can_attach() can call task_can_attach() with an empty mask.\nThis can lead to cpumask_any_and() returns nr_cpu_ids causing the call\nto dl_bw_of() to crash due to percpu value access of an out of bound\nCPU value. For example:\n\n\t[80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0\n\t :\n\t[80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0\n\t :\n\t[80468.207946] Call Trace:\n\t[80468.208947] cpuset_can_attach+0xa0/0x140\n\t[80468.209953] cgroup_migrate_execute+0x8c/0x490\n\t[80468.210931] cgroup_update_dfl_csses+0x254/0x270\n\t[80468.211898] cgroup_subtree_control_write+0x322/0x400\n\t[80468.212854] kernfs_fop_write_iter+0x11c/0x1b0\n\t[80468.213777] new_sync_write+0x11f/0x1b0\n\t[80468.214689] vfs_write+0x1eb/0x280\n\t[80468.215592] ksys_write+0x5f/0xe0\n\t[80468.216463] do_syscall_64+0x5c/0x80\n\t[80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFix that by using effective_cpus instead. For cgroup v1, effective_cpus\nis the same as cpus_allowed. For v2, effective_cpus is the real cpumask\nto be used by tasks within the cpuset anyway.\n\nAlso update task_can_attach()'s 2nd argument name to cs_effective_cpus to\nreflect the change. In addition, a check is added to task_can_attach()\nto guard against the possibility that cpumask_any_and() may return a\nvalue >= nr_cpu_ids.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50103" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4", "url": "https://git.kernel.org/stable/c/147f66d22f58712dce7ccdd6a1f6cb3ee8042df4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b", "url": "https://git.kernel.org/stable/c/336626564b58071b8980a4e6a31a8f5d92705d9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/357f3f0e522a6ce1ce4a571cb780d9861d53bec7", "url": "https://git.kernel.org/stable/c/357f3f0e522a6ce1ce4a571cb780d9861d53bec7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6e8d40d43ae4dec00c8fea2593eeea3114b8f44", "url": "https://git.kernel.org/stable/c/b6e8d40d43ae4dec00c8fea2593eeea3114b8f44" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f56607b44c9896e51678a7e8cdd3a5479f4b4548", "url": "https://git.kernel.org/stable/c/f56607b44c9896e51678a7e8cdd3a5479f4b4548" } ], "release_date": "2025-06-18T11:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T11:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31696", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31696" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1", "url": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627", "url": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92", "url": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3", "url": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618", "url": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b", "url": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383", "url": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0", "url": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0" } ], "release_date": "2026-05-01T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T14:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43076", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline data i_size during inode read\n\nWhen reading an inode from disk, ocfs2_validate_inode_block() performs\nvarious sanity checks but does not validate the size of inline data. If\nthe filesystem is corrupted, an inode's i_size can exceed the actual\ninline data capacity (id_count).\n\nThis causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data\nbuffer, triggering a use-after-free when accessing directory entries from\nfreed memory.\n\nIn the syzbot report:\n - i_size was 1099511627576 bytes (~1TB)\n - Actual inline data capacity (id_count) is typically <256 bytes\n - A garbage rec_len (54648) caused ctx->pos to jump out of bounds\n - This triggered a UAF in ocfs2_check_dir_entry()\n\nFix by adding a validation check in ocfs2_validate_inode_block() to ensure\ninodes with inline data have i_size <= id_count. This catches the\ncorruption early during inode read and prevents all downstream code from\noperating on invalid data.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43076" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2", "url": "https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f", "url": "https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63", "url": "https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc", "url": "https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd", "url": "https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b", "url": "https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39", "url": "https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1", "url": "https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1" } ], "release_date": "2026-05-06T07:40:13Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T07:40:13Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46218", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Add bounds checking to ib_{get,set}_value\n\nThe uvd/vce/vcn code accesses the IB at predefined offsets without\nchecking that the IB is large enough. Check the bounds here. The caller\nis responsible for making sure it can handle arbitrary return values.\n\nAlso make the idx a uint32_t to prevent overflows causing the condition\nto fail.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46218" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53f", "url": "https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5da6c6430be0acb25b4242bce0323fc514d4e3cf", "url": "https://git.kernel.org/stable/c/5da6c6430be0acb25b4242bce0323fc514d4e3cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9e", "url": "https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7d", "url": "https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7", "url": "https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6", "url": "https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6" } ], "release_date": "2026-05-28T09:40:34Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T09:40:34Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23406", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[ 94.984676] ==================================================================\n[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 94.986329] Call Trace:\n[ 94.986341] \n[ 94.986347] dump_stack_lvl+0x5e/0x80\n[ 94.986374] print_report+0xc8/0x270\n[ 94.986384] ? aa_dfa_match+0x5ae/0x760\n[ 94.986388] kasan_report+0x118/0x150\n[ 94.986401] ? aa_dfa_match+0x5ae/0x760\n[ 94.986405] aa_dfa_match+0x5ae/0x760\n[ 94.986408] __aa_path_perm+0x131/0x400\n[ 94.986418] aa_path_perm+0x219/0x2f0\n[ 94.986424] apparmor_file_open+0x345/0x570\n[ 94.986431] security_file_open+0x5c/0x140\n[ 94.986442] do_dentry_open+0x2f6/0x1120\n[ 94.986450] vfs_open+0x38/0x2b0\n[ 94.986453] ? may_open+0x1e2/0x2b0\n[ 94.986466] path_openat+0x231b/0x2b30\n[ 94.986469] ? __x64_sys_openat+0xf8/0x130\n[ 94.986477] do_file_open+0x19d/0x360\n[ 94.986487] do_sys_openat2+0x98/0x100\n[ 94.986491] __x64_sys_openat+0xf8/0x130\n[ 94.986499] do_syscall_64+0x8e/0x660\n[ 94.986515] ? count_memcg_events+0x15f/0x3c0\n[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0\n[ 94.986551] ? vma_start_read+0xf0/0x320\n[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0\n[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986588] ? irqentry_exit+0x3c/0x590\n[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23406" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0510d1ba0976f97f521feb2b75b0572ea5df3ceb", "url": "https://git.kernel.org/stable/c/0510d1ba0976f97f521feb2b75b0572ea5df3ceb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1fc94f16098213d01e56c97feed9b3ecf0147a37", "url": "https://git.kernel.org/stable/c/1fc94f16098213d01e56c97feed9b3ecf0147a37" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/383b7270faf42564f133134c2fc3c24bbae52615", "url": "https://git.kernel.org/stable/c/383b7270faf42564f133134c2fc3c24bbae52615" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a184f7cbdeaad17e16dedf3c17d0cd622edfed8", "url": "https://git.kernel.org/stable/c/5a184f7cbdeaad17e16dedf3c17d0cd622edfed8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8756b68edae37ff546c02091989a4ceab3f20abd", "url": "https://git.kernel.org/stable/c/8756b68edae37ff546c02091989a4ceab3f20abd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b73c1dff8a9d7eeaebabf8097a5b2de192f40913", "url": "https://git.kernel.org/stable/c/b73c1dff8a9d7eeaebabf8097a5b2de192f40913" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b", "url": "https://git.kernel.org/stable/c/c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42", "url": "https://git.kernel.org/stable/c/f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42" } ], "release_date": "2026-04-01T08:36:36Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-01T08:36:36Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64587", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64587" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c", "url": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707", "url": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172", "url": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96", "url": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99", "url": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388", "url": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564", "url": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62", "url": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62" } ], "release_date": "2026-08-06T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-06T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39686", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Make insn_rw_emulate_bits() do insn->n samples\n\nThe `insn_rw_emulate_bits()` function is used as a default handler for\n`INSN_READ` instructions for subdevices that have a handler for\n`INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default\nhandler for `INSN_WRITE` instructions for subdevices that have a handler\nfor `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the\n`INSN_READ` or `INSN_WRITE` instruction handling with a constructed\n`INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE`\ninstructions are supposed to be able read or write multiple samples,\nindicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently\nonly handles a single sample. For `INSN_READ`, the comedi core will\ncopy `insn->n` samples back to user-space. (That triggered KASAN\nkernel-infoleak errors when `insn->n` was greater than 1, but that is\nbeing fixed more generally elsewhere in the comedi core.)\n\nMake `insn_rw_emulate_bits()` either handle `insn->n` samples, or return\nan error, to conform to the general expectation for `INSN_READ` and\n`INSN_WRITE` handlers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39686" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7afba9221f70d4cbce0f417c558879cba0eb5e66", "url": "https://git.kernel.org/stable/c/7afba9221f70d4cbce0f417c558879cba0eb5e66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/842f307a1d115b24f2bcb2415c4e344f11f55930", "url": "https://git.kernel.org/stable/c/842f307a1d115b24f2bcb2415c4e344f11f55930" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92352ed2f9ac422181e381c2430c2d0dfb46faa0", "url": "https://git.kernel.org/stable/c/92352ed2f9ac422181e381c2430c2d0dfb46faa0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab77e85bd3bc006ef40738f26f446a660813da44", "url": "https://git.kernel.org/stable/c/ab77e85bd3bc006ef40738f26f446a660813da44" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae8bc1f07bcb31b8636420e03d1f9c3df6219a2b", "url": "https://git.kernel.org/stable/c/ae8bc1f07bcb31b8636420e03d1f9c3df6219a2b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc0a2f142d655700db43de90cb6abf141b73d908", "url": "https://git.kernel.org/stable/c/dc0a2f142d655700db43de90cb6abf141b73d908" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-05T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-05T18:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39955", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().\n\nsyzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk\nin the TCP_ESTABLISHED state. [0]\n\nsyzbot reused the server-side TCP Fast Open socket as a new client before\nthe TFO socket completes 3WHS:\n\n 1. accept()\n 2. connect(AF_UNSPEC)\n 3. connect() to another destination\n\nAs of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\n\nSince tcp_disconnect() forgot to clear tcp_sk(sk)->fastopen_rsk, the\nretransmit timer triggered the warning and the intended packet was not\nretransmitted.\n\nLet's call reqsk_fastopen_remove() in tcp_disconnect().\n\n[0]:\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nModules linked in:\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 <0f> 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\nFS: 0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\nCall Trace:\n \n tcp_write_timer (net/ipv4/tcp_timer.c:738)\n call_timer_fn (kernel/time/timer.c:1747)\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\n ", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39955" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17d699727577814198d744d6afe54735c6b54c99", "url": "https://git.kernel.org/stable/c/17d699727577814198d744d6afe54735c6b54c99" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33a4fdf0b4a25f8ce65380c3b0136b407ca57609", "url": "https://git.kernel.org/stable/c/33a4fdf0b4a25f8ce65380c3b0136b407ca57609" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01", "url": "https://git.kernel.org/stable/c/45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ec092a91ff351dcde89c23e795b73a328274db6", "url": "https://git.kernel.org/stable/c/7ec092a91ff351dcde89c23e795b73a328274db6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4378dedd6e07e62f2fccb17d78c9665718763d0", "url": "https://git.kernel.org/stable/c/a4378dedd6e07e62f2fccb17d78c9665718763d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae313d14b45eca7a6bb29cb9bf396d977e7d28fb", "url": "https://git.kernel.org/stable/c/ae313d14b45eca7a6bb29cb9bf396d977e7d28fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dfd06131107e7b699ef1e2a24ed2f7d17c917753", "url": "https://git.kernel.org/stable/c/dfd06131107e7b699ef1e2a24ed2f7d17c917753" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa4749c065644af4db496b338452a69a3e5147d9", "url": "https://git.kernel.org/stable/c/fa4749c065644af4db496b338452a69a3e5147d9" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2025-10-09T10:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-09T10:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47379", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd\n\nKASAN reports a use-after-free report when doing fuzz test:\n\n[693354.104835] ==================================================================\n[693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338\n\n[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147\n[693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018\n[693354.105612] Call Trace:\n[693354.105621] dump_stack+0xf1/0x19b\n[693354.105626] ? show_regs_print_info+0x5/0x5\n[693354.105634] ? printk+0x9c/0xc3\n[693354.105638] ? cpumask_weight+0x1f/0x1f\n[693354.105648] print_address_description+0x70/0x360\n[693354.105654] kasan_report+0x1b2/0x330\n[693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105670] bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105675] ? bfq_cpd_init+0x20/0x20\n[693354.105683] cgroup_file_write+0x3aa/0x510\n[693354.105693] ? ___slab_alloc+0x507/0x540\n[693354.105698] ? cgroup_file_poll+0x60/0x60\n[693354.105702] ? 0xffffffff89600000\n[693354.105708] ? usercopy_abort+0x90/0x90\n[693354.105716] ? mutex_lock+0xef/0x180\n[693354.105726] kernfs_fop_write+0x1ab/0x280\n[693354.105732] ? cgroup_file_poll+0x60/0x60\n[693354.105738] vfs_write+0xe7/0x230\n[693354.105744] ksys_write+0xb0/0x140\n[693354.105749] ? __ia32_sys_read+0x50/0x50\n[693354.105760] do_syscall_64+0x112/0x370\n[693354.105766] ? syscall_return_slowpath+0x260/0x260\n[693354.105772] ? do_page_fault+0x9b/0x270\n[693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0\n[693354.105784] ? enter_from_user_mode+0x30/0x30\n[693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.105875] Allocated by task 1453337:\n[693354.106001] kasan_kmalloc+0xa0/0xd0\n[693354.106006] kmem_cache_alloc_node_trace+0x108/0x220\n[693354.106010] bfq_pd_alloc+0x96/0x120\n[693354.106015] blkcg_activate_policy+0x1b7/0x2b0\n[693354.106020] bfq_create_group_hierarchy+0x1e/0x80\n[693354.106026] bfq_init_queue+0x678/0x8c0\n[693354.106031] blk_mq_init_sched+0x1f8/0x460\n[693354.106037] elevator_switch_mq+0xe1/0x240\n[693354.106041] elevator_switch+0x25/0x40\n[693354.106045] elv_iosched_store+0x1a1/0x230\n[693354.106049] queue_attr_store+0x78/0xb0\n[693354.106053] kernfs_fop_write+0x1ab/0x280\n[693354.106056] vfs_write+0xe7/0x230\n[693354.106060] ksys_write+0xb0/0x140\n[693354.106064] do_syscall_64+0x112/0x370\n[693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106114] Freed by task 1453336:\n[693354.106225] __kasan_slab_free+0x130/0x180\n[693354.106229] kfree+0x90/0x1b0\n[693354.106233] blkcg_deactivate_policy+0x12c/0x220\n[693354.106238] bfq_exit_queue+0xf5/0x110\n[693354.106241] blk_mq_exit_sched+0x104/0x130\n[693354.106245] __elevator_exit+0x45/0x60\n[693354.106249] elevator_switch_mq+0xd6/0x240\n[693354.106253] elevator_switch+0x25/0x40\n[693354.106257] elv_iosched_store+0x1a1/0x230\n[693354.106261] queue_attr_store+0x78/0xb0\n[693354.106264] kernfs_fop_write+0x1ab/0x280\n[693354.106268] vfs_write+0xe7/0x230\n[693354.106271] ksys_write+0xb0/0x140\n[693354.106275] do_syscall_64+0x112/0x370\n[693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106329] The buggy address belongs to the object at ffff888be0a35580\n which belongs to the cache kmalloc-1k of size 1024\n[693354.106736] The buggy address is located 228 bytes inside of\n 1024-byte region [ffff888be0a35580, ffff888be0a35980)\n[693354.107114] The buggy address belongs to the page:\n[693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0\n[693354.107606] flags: 0x17ffffc0008100(slab|head)\n[693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080\n[693354.108020] r\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47379" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c2c69e010431b0157c9454adcdd2305809bf9fb", "url": "https://git.kernel.org/stable/c/7c2c69e010431b0157c9454adcdd2305809bf9fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/858560b27645e7e97aca37ee8f232cccd658fbd2", "url": "https://git.kernel.org/stable/c/858560b27645e7e97aca37ee8f232cccd658fbd2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d12ddd843f1877de1f7dd2aeea4907cf9ff3ac08", "url": "https://git.kernel.org/stable/c/d12ddd843f1877de1f7dd2aeea4907cf9ff3ac08" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f58d305887ad7b24986d58e881f6806bb81b2bdf", "url": "https://git.kernel.org/stable/c/f58d305887ad7b24986d58e881f6806bb81b2bdf" } ], "release_date": "2024-05-21T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-21T15:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38497", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Fix OOB read on empty string write\n\nWhen writing an empty string to either 'qw_sign' or 'landingPage'\nsysfs attributes, the store functions attempt to access page[l - 1]\nbefore validating that the length 'l' is greater than zero.\n\nThis patch fixes the vulnerability by adding a check at the beginning\nof os_desc_qw_sign_store() and webusb_landingPage_store() to handle\nthe zero-length input case gracefully by returning immediately.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38497" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/15a87206879951712915c03c8952a73d6a74721e", "url": "https://git.kernel.org/stable/c/15a87206879951712915c03c8952a73d6a74721e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22b7897c289cc25d99c603f5144096142a30d897", "url": "https://git.kernel.org/stable/c/22b7897c289cc25d99c603f5144096142a30d897" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2798111f8e504ac747cce911226135d50b8de468", "url": "https://git.kernel.org/stable/c/2798111f8e504ac747cce911226135d50b8de468" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3014168731b7930300aab656085af784edc861f6", "url": "https://git.kernel.org/stable/c/3014168731b7930300aab656085af784edc861f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58bdd5160184645771553ea732da5c2887fc9bd1", "url": "https://git.kernel.org/stable/c/58bdd5160184645771553ea732da5c2887fc9bd1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/783ea37b237a9b524f1e5ca018ea17d772ee0ea0", "url": "https://git.kernel.org/stable/c/783ea37b237a9b524f1e5ca018ea17d772ee0ea0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78b41148cfea2a3f04d87adf3a71b21735820a37", "url": "https://git.kernel.org/stable/c/78b41148cfea2a3f04d87adf3a71b21735820a37" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76", "url": "https://git.kernel.org/stable/c/d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-28T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-28T12:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-39189", "notes": [ { "category": "description", "text": "An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-39189" }, { "category": "external", "summary": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2309", "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2309" }, { "category": "external", "summary": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.17", "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.17" }, { "category": "external", "summary": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6cd88243c7e03845a450795e134b488fc2afb736", "url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6cd88243c7e03845a450795e134b488fc2afb736" }, { "category": "external", "summary": "https://github.com/torvalds/linux/commit/6cd88243c7e03845a450795e134b488fc2afb736", "url": "https://github.com/torvalds/linux/commit/6cd88243c7e03845a450795e134b488fc2afb736" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230214-0007/", "url": "https://security.netapp.com/advisory/ntap-20230214-0007/" }, { "category": "external", "summary": "https://www.debian.org/security/2023/dsa-5480", "url": "https://www.debian.org/security/2023/dsa-5480" } ], "release_date": "2022-09-02T05:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2022-09-02T05:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53000", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: prevent potential spectre v1 gadgets\n\nMost netlink attributes are parsed and validated from\n__nla_validate_parse() or validate_nla()\n\n u16 type = nla_type(nla);\n\n if (type == 0 || type > maxtype) {\n /* error or continue */\n }\n\n@type is then used as an array index and can be used\nas a Spectre v1 gadget.\n\narray_index_nospec() can be used to prevent leaking\ncontent of kernel memory to malicious users.\n\nThis should take care of vast majority of netlink uses,\nbut an audit is needed to take care of others where\nvalidation is not yet centralized in core netlink functions.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53000" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff", "url": "https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45", "url": "https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d", "url": "https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184", "url": "https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455", "url": "https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455" } ], "release_date": "2025-03-27T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-03-27T17:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53321", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: drop short frames\n\nWhile technically some control frames like ACK are shorter and\nend after Address 1, such frames shouldn't be forwarded through\nwmediumd or similar userspace, so require the full 3-address\nheader to avoid accessing invalid memory if shorter frames are\npassed in.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53321" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3beb97bed860d95b14ad23578ce8ddaea62023db", "url": "https://git.kernel.org/stable/c/3beb97bed860d95b14ad23578ce8ddaea62023db" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/672205c6f2d11978fcd7f0f336bb2c708e28874b", "url": "https://git.kernel.org/stable/c/672205c6f2d11978fcd7f0f336bb2c708e28874b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89a41ed7f21476301659ebd25ccb48a60791c1a7", "url": "https://git.kernel.org/stable/c/89a41ed7f21476301659ebd25ccb48a60791c1a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9a175e3b250b0dc6e152988040aa5014e98e61e", "url": "https://git.kernel.org/stable/c/b9a175e3b250b0dc6e152988040aa5014e98e61e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c64ee9dd335832d5e2ab0a8fc83a34ad4c729799", "url": "https://git.kernel.org/stable/c/c64ee9dd335832d5e2ab0a8fc83a34ad4c729799" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6", "url": "https://git.kernel.org/stable/c/fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6" } ], "release_date": "2025-09-16T16:11:57Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T16:11:57Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23073", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: Fix memory corruption due to not set vif driver data size\n\nThe struct ieee80211_vif contains trailing space for vif driver data,\nwhen struct ieee80211_vif is allocated, the total memory size that is\nallocated is sizeof(struct ieee80211_vif) + size of vif driver data.\nThe size of vif driver data is set by each WiFi driver as needed.\n\nThe RSI911x driver does not set vif driver data size, no trailing space\nfor vif driver data is therefore allocated past struct ieee80211_vif .\nThe RSI911x driver does however use the vif driver data to store its\nvif driver data structure \"struct vif_priv\". An access to vif->drv_priv\nleads to access out of struct ieee80211_vif bounds and corruption of\nsome memory.\n\nIn case of the failure observed locally, rsi_mac80211_add_interface()\nwould write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv;\nvif_info->vap_id = vap_idx. This write corrupts struct fq_tin member\nstruct list_head new_flows . The flow = list_first_entry(head, struct\nfq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus\naddress, which when accessed causes a crash.\n\nThe trigger is very simple, boot the machine with init=/bin/sh , mount\ndevtmpfs, sysfs, procfs, and then do \"ip link set wlan0 up\", \"sleep 1\",\n\"ip link set wlan0 down\" and the crash occurs.\n\nFix this by setting the correct size of vif driver data, which is the\nsize of \"struct vif_priv\", so that memory is allocated and the driver\ncan store its driver data in it, instead of corrupting memory around\nit.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23073" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0", "url": "https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1", "url": "https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc", "url": "https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33", "url": "https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a", "url": "https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4", "url": "https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b", "url": "https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b" } ], "release_date": "2026-02-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56756", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix freeing of the HMB descriptor table\n\nThe HMB descriptor table is sized to the maximum number of descriptors\nthat could be used for a given device, but __nvme_alloc_host_mem could\nbreak out of the loop earlier on memory allocation failure and end up\nusing less descriptors than planned for, which leads to an incorrect\nsize passed to dma_free_coherent.\n\nIn practice this was not showing up because the number of descriptors\ntends to be low and the dma coherent allocator always allocates and\nfrees at least a page.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56756" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a551358137525ae8e0d7a", "url": "https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a551358137525ae8e0d7a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015", "url": "https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269", "url": "https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c4d4d92849d", "url": "https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c4d4d92849d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/869cf50b9c9d1059f5223f79ef68fc0bc6210095", "url": "https://git.kernel.org/stable/c/869cf50b9c9d1059f5223f79ef68fc0bc6210095" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac22240540e0c5230d8c4138e3778420b712716a", "url": "https://git.kernel.org/stable/c/ac22240540e0c5230d8c4138e3778420b712716a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386", "url": "https://git.kernel.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb96d5cfa97a7363245b3dd523f475b04296d87b", "url": "https://git.kernel.org/stable/c/fb96d5cfa97a7363245b3dd523f475b04296d87b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-29T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-29T12:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-37879", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/net: fix improper handling of bogus negative read/write replies\n\nIn p9_client_write() and p9_client_read_once(), if the server\nincorrectly replies with success but a negative write/read count then we\nwould consider written (negative) <= rsize (positive) because both\nvariables were signed.\n\nMake variables unsigned to avoid this problem.\n\nThe reproducer linked below now fails with the following error instead\nof a null pointer deref:\n9pnet: bogus RWRITE count (4294967295 > 3)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37879" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330", "url": "https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12b", "url": "https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5", "url": "https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034", "url": "https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73b", "url": "https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-09T06:45:43Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-09T06:45:43Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-49991", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer\n\nPass pointer reference to amdgpu_bo_unref to clear the correct pointer,\notherwise amdgpu_bo_unref clear the local variable, the original pointer\nnot set to NULL, this could cause use-after-free bug.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-49991" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/30ceb873cc2e97348d9da2265b2d1ddf07f682e1", "url": "https://git.kernel.org/stable/c/30ceb873cc2e97348d9da2265b2d1ddf07f682e1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c9289806591807e4e3be9a23df8ee2069180055", "url": "https://git.kernel.org/stable/c/6c9289806591807e4e3be9a23df8ee2069180055" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71f3240f82987f0f070ea5bed559033de7d4c0e1", "url": "https://git.kernel.org/stable/c/71f3240f82987f0f070ea5bed559033de7d4c0e1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c86ad39140bbcb9dc75a10046c2221f657e8083b", "url": "https://git.kernel.org/stable/c/c86ad39140bbcb9dc75a10046c2221f657e8083b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c", "url": "https://git.kernel.org/stable/c/e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-10-21T18:02:33Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-10-21T18:02:33Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53680", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL\n\nOPDESC() simply indexes into nfsd4_ops[] by the op's operation\nnumber, without range checking that value. It assumes callers are\ncareful to avoid calling it with an out-of-bounds opnum value.\n\nnfsd4_decode_compound() is not so careful, and can invoke OPDESC()\nwith opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end\nof nfsd4_ops[].", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53680" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50827896c365e0f6c8b55ed56d444dafd87c92c5", "url": "https://git.kernel.org/stable/c/50827896c365e0f6c8b55ed56d444dafd87c92c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/804d8e0a6e54427268790472781e03bc243f4ee3", "url": "https://git.kernel.org/stable/c/804d8e0a6e54427268790472781e03bc243f4ee3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a64160124d5a078be0c380b1e8a0bad2d040d3a1", "url": "https://git.kernel.org/stable/c/a64160124d5a078be0c380b1e8a0bad2d040d3a1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f352c41fa718482979e7e6b71b4da2b718e381cc", "url": "https://git.kernel.org/stable/c/f352c41fa718482979e7e6b71b4da2b718e381cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ffcbcf087581ae68ddc0a21460f7ecd4315bdd0e", "url": "https://git.kernel.org/stable/c/ffcbcf087581ae68ddc0a21460f7ecd4315bdd0e" } ], "release_date": "2025-10-07T15:21:34Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-07T15:21:34Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-46826", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nELF: fix kernel.randomize_va_space double read\n\nELF loader uses \"randomize_va_space\" twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\n\nIssue exactly one load for consistent value across one exec.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-46826" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1cf8cd80903073440b6ea055811d04edd24fe4f7", "url": "https://git.kernel.org/stable/c/1cf8cd80903073440b6ea055811d04edd24fe4f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27", "url": "https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a97388a807b6ab5538aa8f8537b2463c6988bd2", "url": "https://git.kernel.org/stable/c/2a97388a807b6ab5538aa8f8537b2463c6988bd2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53f17409abf61f66b6f05aff795e938e5ba811d1", "url": "https://git.kernel.org/stable/c/53f17409abf61f66b6f05aff795e938e5ba811d1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-09-27T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-09-27T13:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-37927", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid\n\nThere is a string parsing logic error which can lead to an overflow of hid\nor uid buffers. Comparing ACPIID_LEN against a total string length doesn't\ntake into account the lengths of individual hid and uid buffers so the\ncheck is insufficient in some cases. For example if the length of hid\nstring is 4 and the length of the uid string is 260, the length of str\nwill be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer\nwhich size is 256.\n\nThe same applies to the hid string with length 13 and uid string with\nlength 250.\n\nCheck the length of hid and uid strings separately to prevent\nbuffer overflow.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37927" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10d901a95f8e766e5aa0bb9a983fb41271f64718", "url": "https://git.kernel.org/stable/c/10d901a95f8e766e5aa0bb9a983fb41271f64718" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13d67528e1ae4486e9ab24b70122fab104c73c29", "url": "https://git.kernel.org/stable/c/13d67528e1ae4486e9ab24b70122fab104c73c29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b65060c84ee4d8dc64fae6d2728b528e9e832e1", "url": "https://git.kernel.org/stable/c/2b65060c84ee4d8dc64fae6d2728b528e9e832e1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/466d9da267079a8d3b69fa72dfa3a732e1f6dbb5", "url": "https://git.kernel.org/stable/c/466d9da267079a8d3b69fa72dfa3a732e1f6dbb5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8dee308e4c01dea48fc104d37f92d5b58c50b96c", "url": "https://git.kernel.org/stable/c/8dee308e4c01dea48fc104d37f92d5b58c50b96c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a65ebfed65fa62797ec1f5f1dcf7adb157a2de1e", "url": "https://git.kernel.org/stable/c/a65ebfed65fa62797ec1f5f1dcf7adb157a2de1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3f37faa71f5d26dd2144b3f2b14525ec8f5e41f", "url": "https://git.kernel.org/stable/c/c3f37faa71f5d26dd2144b3f2b14525ec8f5e41f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8bdfc0297965bb13fa439d36ca9c4f7c8447f0f", "url": "https://git.kernel.org/stable/c/c8bdfc0297965bb13fa439d36ca9c4f7c8447f0f" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-05-20T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-20T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64580", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()\n\nOn the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst()\nreleases the device reference with netdev_put() but leaves\nxdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev)\nagain, so the same net_device reference is released twice, underflowing\nits refcount (ref_tracker WARNING + \"unregister_netdevice: waiting for\n to become free\").\n\nClear xdst->u.dst.dev after the netdev_put(), the same way the XFRM\ndevice-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in\nnet/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.\n\n ref_tracker: reference already released.\n ref_tracker: allocated in:\n xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)\n ...\n udpv6_sendmsg (net/ipv6/udp.c:1696)\n ...\n ref_tracker: freed in:\n xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)\n ...\n WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780\n dst_destroy (net/core/dst.c:115)\n rcu_core\n handle_softirqs\n ...", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64580" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/136992de9bb91871084ae52d172610541c76e4d2", "url": "https://git.kernel.org/stable/c/136992de9bb91871084ae52d172610541c76e4d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43de8a49335e611adb271bbd52e84dfbc11fc185", "url": "https://git.kernel.org/stable/c/43de8a49335e611adb271bbd52e84dfbc11fc185" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97e032e5733e49471fb73de117ea2ac1ac7c479a", "url": "https://git.kernel.org/stable/c/97e032e5733e49471fb73de117ea2ac1ac7c479a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df6856c2dda9187601d29b5fbd7a81b3b178cedf", "url": "https://git.kernel.org/stable/c/df6856c2dda9187601d29b5fbd7a81b3b178cedf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e078da1b4e11390cff3201c19a9a1fe70c5b934f", "url": "https://git.kernel.org/stable/c/e078da1b4e11390cff3201c19a9a1fe70c5b934f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff636d7b7cba6dea82ecf580415ea57f2c1a11b6", "url": "https://git.kernel.org/stable/c/ff636d7b7cba6dea82ecf580415ea57f2c1a11b6" } ], "release_date": "2026-08-05T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-05T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56748", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()\n\nHook \"qed_ops->common->sb_init = qed_sb_init\" does not release the DMA\nmemory sb_virt when it fails. Add dma_free_coherent() to free it. This\nis the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56748" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e04bd5a11dffe8c1c0e4c9fc79f7d3cd6182dd5", "url": "https://git.kernel.org/stable/c/0e04bd5a11dffe8c1c0e4c9fc79f7d3cd6182dd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64654bf5efb3f748e6fc41227adda689618ce9c4", "url": "https://git.kernel.org/stable/c/64654bf5efb3f748e6fc41227adda689618ce9c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78a169dc69fbdaf114c40e2d56955bf6bd4fc3c0", "url": "https://git.kernel.org/stable/c/78a169dc69fbdaf114c40e2d56955bf6bd4fc3c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c1832287b21ff68c4e3625e63cc7619edf5908b", "url": "https://git.kernel.org/stable/c/7c1832287b21ff68c4e3625e63cc7619edf5908b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97384449ddfc07f12ca75f510eb070020d7abb34", "url": "https://git.kernel.org/stable/c/97384449ddfc07f12ca75f510eb070020d7abb34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a56777a3ef5b35e24a20c4418bcf88bad033807a", "url": "https://git.kernel.org/stable/c/a56777a3ef5b35e24a20c4418bcf88bad033807a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b514f45e0fe18d763a1afc34401b1585333cb329", "url": "https://git.kernel.org/stable/c/b514f45e0fe18d763a1afc34401b1585333cb329" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb", "url": "https://git.kernel.org/stable/c/c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-29T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-29T12:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-35864", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_valid_lease_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-35864" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/705c76fbf726c7a2f6ff9143d4013b18daaaebf1", "url": "https://git.kernel.org/stable/c/705c76fbf726c7a2f6ff9143d4013b18daaaebf1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8344e2b69bde63f713b0aa796d70dbeadffddfb", "url": "https://git.kernel.org/stable/c/a8344e2b69bde63f713b0aa796d70dbeadffddfb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c868cabdf6fdd61bea54532271f4708254e57fc5", "url": "https://git.kernel.org/stable/c/c868cabdf6fdd61bea54532271f4708254e57fc5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f92739fdd4522c4291277136399353d7c341fae4", "url": "https://git.kernel.org/stable/c/f92739fdd4522c4291277136399353d7c341fae4" } ], "release_date": "2024-05-19T08:34:22Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-19T08:34:22Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-41013", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't walk off the end of a directory data block\n\nThis adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry\nto make sure don't stray beyond valid memory region. Before patching, the\nloop simply checks that the start offset of the dup and dep is within the\nrange. So in a crafted image, if last entry is xfs_dir2_data_unused, we\ncan change dup->length to dup->length-1 and leave 1 byte of space. In the\nnext traversal, this space will be considered as dup or dep. We may\nencounter an out of bound read when accessing the fixed members.\n\nIn the patch, we make sure that the remaining bytes large enough to hold\nan unused entry before accessing xfs_dir2_data_unused and\nxfs_dir2_data_unused is XFS_DIR2_DATA_ALIGN byte aligned. We also make\nsure that the remaining bytes large enough to hold a dirent with a\nsingle-byte name before accessing xfs_dir2_data_entry.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-41013" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a", "url": "https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d", "url": "https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b", "url": "https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2024-07-29T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-07-29T07:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50066", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: fix aq_vec index out of range error\n\nThe final update statement of the for loop exceeds the array range, the\ndereference of self->aq_vec[i] is not checked and then leads to the\nindex out of range error.\nAlso fixed this kind of coding style in other for loop.\n\n[ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48\n[ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]'\n[ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2\n[ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022\n[ 97.937611] Workqueue: events_unbound async_run_entry_fn\n[ 97.937616] Call Trace:\n[ 97.937617] \n[ 97.937619] dump_stack_lvl+0x49/0x63\n[ 97.937624] dump_stack+0x10/0x16\n[ 97.937626] ubsan_epilogue+0x9/0x3f\n[ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 97.937629] ? __scm_send+0x348/0x440\n[ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic]\n[ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic]\n[ 97.937644] aq_suspend_common+0x88/0x90 [atlantic]\n[ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic]\n[ 97.937653] pci_pm_suspend+0x7e/0x1a0\n[ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0\n[ 97.937657] dpm_run_callback+0x54/0x190\n[ 97.937660] __device_suspend+0x14c/0x4d0\n[ 97.937661] async_suspend+0x23/0x70\n[ 97.937663] async_run_entry_fn+0x33/0x120\n[ 97.937664] process_one_work+0x21f/0x3f0\n[ 97.937666] worker_thread+0x4a/0x3c0\n[ 97.937668] ? process_one_work+0x3f0/0x3f0\n[ 97.937669] kthread+0xf0/0x120\n[ 97.937671] ? kthread_complete_and_exit+0x20/0x20\n[ 97.937672] ret_from_fork+0x22/0x30\n[ 97.937676] \n\nv2. fixed \"warning: variable 'aq_vec' set but not used\"\n\nv3. simplified a for loop", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50066" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23bf155476539354ab5c8cc9bb460fd1209b39b5", "url": "https://git.kernel.org/stable/c/23bf155476539354ab5c8cc9bb460fd1209b39b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ba5e47fb75fbb8fab45f5c1bc8d5c33d8834bd3", "url": "https://git.kernel.org/stable/c/2ba5e47fb75fbb8fab45f5c1bc8d5c33d8834bd3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/422a02a771599cac96f2b2900d993e0bb7ba5b88", "url": "https://git.kernel.org/stable/c/422a02a771599cac96f2b2900d993e0bb7ba5b88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df60c534d4c5a681172952dd4b475a5d818b3a86", "url": "https://git.kernel.org/stable/c/df60c534d4c5a681172952dd4b475a5d818b3a86" } ], "release_date": "2025-06-18T11:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T11:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53577", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cpumap: Make sure kthread is running before map update returns\n\nThe following warning was reported when running stress-mode enabled\nxdp_redirect_cpu with some RT threads:\n\n ------------[ cut here ]------------\n WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135\n CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n Workqueue: events cpu_map_kthread_stop\n RIP: 0010:put_cpu_map_entry+0xda/0x220\n ......\n Call Trace:\n \n ? show_regs+0x65/0x70\n ? __warn+0xa5/0x240\n ......\n ? put_cpu_map_entry+0xda/0x220\n cpu_map_kthread_stop+0x41/0x60\n process_one_work+0x6b0/0xb80\n worker_thread+0x96/0x720\n kthread+0x1a5/0x1f0\n ret_from_fork+0x3a/0x70\n ret_from_fork_asm+0x1b/0x30\n \n\nThe root cause is the same as commit 436901649731 (\"bpf: cpumap: Fix memory\nleak in cpu_map_update_elem\"). The kthread is stopped prematurely by\nkthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call\ncpu_map_kthread_run() at all but XDP program has already queued some\nframes or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks\nthe ptr_ring, it will find it was not emptied and report a warning.\n\nAn alternative fix is to use __cpu_map_ring_cleanup() to drop these\npending frames or skbs when kthread_stop() returns -EINTR, but it may\nconfuse the user, because these frames or skbs have been handled\ncorrectly by XDP program. So instead of dropping these frames or skbs,\njust make sure the per-cpu kthread is running before\n__cpu_map_entry_alloc() returns.\n\nAfter apply the fix, the error handle for kthread_stop() will be\nunnecessary because it will always return 0, so just remove it.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53577" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/640a604585aa30f93e39b17d4d6ba69fcb1e66c9", "url": "https://git.kernel.org/stable/c/640a604585aa30f93e39b17d4d6ba69fcb1e66c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a1178a3671b40746830d355836b72e47ceb2490", "url": "https://git.kernel.org/stable/c/7a1178a3671b40746830d355836b72e47ceb2490" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b44d28b98f185d2f2348aa3c3636838c316f889e", "url": "https://git.kernel.org/stable/c/b44d28b98f185d2f2348aa3c3636838c316f889e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ecb45b852af5e88257020b88bea5ff0798d72aca", "url": "https://git.kernel.org/stable/c/ecb45b852af5e88257020b88bea5ff0798d72aca" } ], "release_date": "2025-10-04T15:17:16Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-04T15:17:16Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31532", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro->uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro->uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro->uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31532" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0", "url": "https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3", "url": "https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a", "url": "https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be", "url": "https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e", "url": "https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc", "url": "https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca", "url": "https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa", "url": "https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc", "url": "https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc" } ], "release_date": "2026-04-23T11:12:44Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-23T11:12:44Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64581", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\n\nFor a connected UDP socket that does not hold: the transmit fast path\n(udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly\nwith an atomic xchg(). A per-socket policy change racing a send can make\nboth sides observe the same old dst and each dst_release() it, dropping\nthe socket's single reference twice and freeing the xfrm_dst bundle while\nit is still referenced:\n\n BUG: KASAN: slab-use-after-free in dst_release\n Write of size 4 at addr ffff88801897b6c0 by task exploit/155\n Call Trace:\n ...\n dst_release (... ./include/linux/rcuref.h:109)\n xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\n do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\n do_sock_setsockopt (net/socket.c:2368)\n __sys_setsockopt (net/socket.c:2393)\n __x64_sys_setsockopt (net/socket.c:2396)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nReachable by an unprivileged user via a user+network namespace.\n\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\nsingle xchg(): whichever side wins releases the dst once, the other sees\nNULL and does nothing. Behaviour is otherwise unchanged.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64581" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294", "url": "https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16", "url": "https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683", "url": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9", "url": "https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925", "url": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d", "url": "https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f", "url": "https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a", "url": "https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a" } ], "release_date": "2026-08-05T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-05T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-22980", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: provide locking for v4_end_grace\n\nWriting to v4_end_grace can race with server shutdown and result in\nmemory being accessed after it was freed - reclaim_str_hashtbl in\nparticularly.\n\nWe cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is\nheld while client_tracking_op->init() is called and that can wait for\nan upcall to nfsdcltrack which can write to v4_end_grace, resulting in a\ndeadlock.\n\nnfsd4_end_grace() is also called by the landromat work queue and this\ndoesn't require locking as server shutdown will stop the work and wait\nfor it before freeing anything that nfsd4_end_grace() might access.\n\nHowever, we must be sure that writing to v4_end_grace doesn't restart\nthe work item after shutdown has already waited for it. For this we\nadd a new flag protected with nn->client_lock. It is set only while it\nis safe to make client tracking calls, and v4_end_grace only schedules\nwork while the flag is set with the spinlock held.\n\nSo this patch adds a nfsd_net field \"client_tracking_active\" which is\nset as described. Another field \"grace_end_forced\", is set when\nv4_end_grace is written. After this is set, and providing\nclient_tracking_active is set, the laundromat is scheduled.\nThis \"grace_end_forced\" field bypasses other checks for whether the\ngrace period has finished.\n\nThis resolves a race which can result in use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22980" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309", "url": "https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4", "url": "https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d", "url": "https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6", "url": "https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0", "url": "https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06", "url": "https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61", "url": "https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2026-01-23T15:24:02Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-23T15:24:02Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38079", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - fix double free in hash_accept\n\nIf accept(2) is called on socket type algif_hash with\nMSG_MORE flag set and crypto_ahash_import fails,\nsk2 is freed. However, it is also freed in af_alg_release,\nleading to slab-use-after-free error.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38079" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967", "url": "https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993", "url": "https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896", "url": "https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633", "url": "https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6", "url": "https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf", "url": "https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547", "url": "https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0f3d09f53534ea385d55ced408f2b67059b16e4", "url": "https://git.kernel.org/stable/c/f0f3d09f53534ea385d55ced408f2b67059b16e4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2025-06-18T09:33:53Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T09:33:53Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-48744", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid field-overflowing memcpy()\n\nIn preparation for FORTIFY_SOURCE performing compile-time and run-time\nfield bounds checking for memcpy(), memmove(), and memset(), avoid\nintentionally writing across neighboring fields.\n\nUse flexible arrays instead of zero-element arrays (which look like they\nare always overflowing) and split the cross-field memcpy() into two halves\nthat can be appropriately bounds-checked by the compiler.\n\nWe were doing:\n\n\t#define ETH_HLEN 14\n\t#define VLAN_HLEN 4\n\t...\n\t#define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)\n\t...\n struct mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi);\n\t...\n struct mlx5_wqe_eth_seg *eseg = &wqe->eth;\n struct mlx5_wqe_data_seg *dseg = wqe->data;\n\t...\n\tmemcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE);\n\ntarget is wqe->eth.inline_hdr.start (which the compiler sees as being\n2 bytes in size), but copying 18, intending to write across start\n(really vlan_tci, 2 bytes). The remaining 16 bytes get written into\nwqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr\n(8 bytes).\n\nstruct mlx5e_tx_wqe {\n struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */\n struct mlx5_wqe_eth_seg eth; /* 16 16 */\n struct mlx5_wqe_data_seg data[]; /* 32 0 */\n\n /* size: 32, cachelines: 1, members: 3 */\n /* last cacheline: 32 bytes */\n};\n\nstruct mlx5_wqe_eth_seg {\n u8 swp_outer_l4_offset; /* 0 1 */\n u8 swp_outer_l3_offset; /* 1 1 */\n u8 swp_inner_l4_offset; /* 2 1 */\n u8 swp_inner_l3_offset; /* 3 1 */\n u8 cs_flags; /* 4 1 */\n u8 swp_flags; /* 5 1 */\n __be16 mss; /* 6 2 */\n __be32 flow_table_metadata; /* 8 4 */\n union {\n struct {\n __be16 sz; /* 12 2 */\n u8 start[2]; /* 14 2 */\n } inline_hdr; /* 12 4 */\n struct {\n __be16 type; /* 12 2 */\n __be16 vlan_tci; /* 14 2 */\n } insert; /* 12 4 */\n __be32 trailer; /* 12 4 */\n }; /* 12 4 */\n\n /* size: 16, cachelines: 1, members: 9 */\n /* last cacheline: 16 bytes */\n};\n\nstruct mlx5_wqe_data_seg {\n __be32 byte_count; /* 0 4 */\n __be32 lkey; /* 4 4 */\n __be64 addr; /* 8 8 */\n\n /* size: 16, cachelines: 1, members: 3 */\n /* last cacheline: 16 bytes */\n};\n\nSo, split the memcpy() so the compiler can reason about the buffer\nsizes.\n\n\"pahole\" shows no size nor member offset changes to struct mlx5e_tx_wqe\nnor struct mlx5e_umr_wqe. \"objdump -d\" shows no meaningful object\ncode changes (i.e. only source line number induced differences and\noptimizations).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-48744" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49bcbe531f79fc35bb10020f7695f9f01e4f0ca8", "url": "https://git.kernel.org/stable/c/49bcbe531f79fc35bb10020f7695f9f01e4f0ca8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8fbdf8c8b8ab82beab882175157650452c46493e", "url": "https://git.kernel.org/stable/c/8fbdf8c8b8ab82beab882175157650452c46493e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad5185735f7dab342fdd0dd41044da4c9ccfef67", "url": "https://git.kernel.org/stable/c/ad5185735f7dab342fdd0dd41044da4c9ccfef67" } ], "release_date": "2024-06-20T11:13:27Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-06-20T11:13:27Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38718", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: linearize cloned gso packets in sctp_rcv\n\nA cloned head skb still shares these frag skbs in fraglist with the\noriginal head skb. It's not safe to access these frag skbs.\n\nsyzbot reported two use-of-uninitialized-memory bugs caused by this:\n\n BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998\n sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331\n sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122\n __release_sock+0x1da/0x330 net/core/sock.c:3106\n release_sock+0x6b/0x250 net/core/sock.c:3660\n sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360\n sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885\n sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031\n inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851\n sock_sendmsg_nosec net/socket.c:718 [inline]\n\nand\n\n BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88\n sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331\n sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148\n __release_sock+0x1d3/0x330 net/core/sock.c:3213\n release_sock+0x6b/0x270 net/core/sock.c:3767\n sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367\n sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886\n sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032\n inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851\n sock_sendmsg_nosec net/socket.c:712 [inline]\n\nThis patch fixes it by linearizing cloned gso packets in sctp_rcv().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38718" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03d0cc6889e02420125510b5444b570f4bbf53d5", "url": "https://git.kernel.org/stable/c/03d0cc6889e02420125510b5444b570f4bbf53d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1bd5214ea681584c5886fea3ba03e49f93a43c0e", "url": "https://git.kernel.org/stable/c/1bd5214ea681584c5886fea3ba03e49f93a43c0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4506bcaabe004d07be8ff09116a3024fbd6aa965", "url": "https://git.kernel.org/stable/c/4506bcaabe004d07be8ff09116a3024fbd6aa965" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d757f17bc2ef2727994ffa6d5d6e4bc4789a770", "url": "https://git.kernel.org/stable/c/7d757f17bc2ef2727994ffa6d5d6e4bc4789a770" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd0e92bb2b7542fb96397ffac639b4f5b099d0cb", "url": "https://git.kernel.org/stable/c/cd0e92bb2b7542fb96397ffac639b4f5b099d0cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0194e391bb493aa6cec56d177b14df6b29188d5", "url": "https://git.kernel.org/stable/c/d0194e391bb493aa6cec56d177b14df6b29188d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea094f38d387d1b0ded5dee4a3e5720aa4ce0139", "url": "https://git.kernel.org/stable/c/ea094f38d387d1b0ded5dee4a3e5720aa4ce0139" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc66772607101bd2030a4332b3bd0ea3b3605250", "url": "https://git.kernel.org/stable/c/fc66772607101bd2030a4332b3bd0ea3b3605250" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd60d8a086191fe33c2d719732d2482052fa6805", "url": "https://git.kernel.org/stable/c/fd60d8a086191fe33c2d719732d2482052fa6805" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-09-04T15:33:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-04T15:33:12Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23243", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umad: Reject negative data_len in ib_umad_write\n\nib_umad_write computes data_len from user-controlled count and the\nMAD header sizes. With a mismatched user MAD header size and RMPP\nheader length, data_len can become negative and reach ib_create_send_mad().\nThis can make the padding calculation exceed the segment size and trigger\nan out-of-bounds memset in alloc_send_rmpp_list().\n\nAdd an explicit check to reject negative data_len before creating the\nsend buffer.\n\nKASAN splat:\n[ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0\n[ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102\n[ 211.365867] ib_create_send_mad+0xa01/0x11b0\n[ 211.365887] ib_umad_write+0x853/0x1c80", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23243" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1371ef6b1ecf3676b8942f5dfb3634fb0648128e", "url": "https://git.kernel.org/stable/c/1371ef6b1ecf3676b8942f5dfb3634fb0648128e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/205955f29c26330b1dc7fdeadd5bb97c38e26f56", "url": "https://git.kernel.org/stable/c/205955f29c26330b1dc7fdeadd5bb97c38e26f56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/362e45fd9069ffa1523f9f1633b606ebf72060d7", "url": "https://git.kernel.org/stable/c/362e45fd9069ffa1523f9f1633b606ebf72060d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/52ab82cc5cf8ada5c3fb6ffe8f32fdb2fc27a34b", "url": "https://git.kernel.org/stable/c/52ab82cc5cf8ada5c3fb6ffe8f32fdb2fc27a34b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5551b02fdbfd85a325bb857f3a8f9c9f33397ed2", "url": "https://git.kernel.org/stable/c/5551b02fdbfd85a325bb857f3a8f9c9f33397ed2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6eb2919474ca105c5b13d19574e25f0ddcf19ca2", "url": "https://git.kernel.org/stable/c/6eb2919474ca105c5b13d19574e25f0ddcf19ca2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c80d688f402539dfc8f336de1380d6b4ee14316", "url": "https://git.kernel.org/stable/c/9c80d688f402539dfc8f336de1380d6b4ee14316" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d", "url": "https://git.kernel.org/stable/c/a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-03-18T10:05:05Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-18T10:05:05Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-26996", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error\n\nWhen ncm function is working and then stop usb0 interface for link down,\neth_stop() is called. At this piont, accidentally if usb transport error\nshould happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled.\n\nAfter that, ncm_disable() is called to disable for ncm unbind\nbut gether_disconnect() is never called since 'in_ep' is not enabled.\n\nAs the result, ncm object is released in ncm unbind\nbut 'dev->port_usb' associated to 'ncm->port' is not NULL.\n\nAnd when ncm bind again to recover netdev, ncm object is reallocated\nbut usb0 interface is already associated to previous released ncm object.\n\nTherefore, once usb0 interface is up and eth_start_xmit() is called,\nreleased ncm object is dereferrenced and it might cause use-after-free memory.\n\n[function unlink via configfs]\n usb0: eth_stop dev->port_usb=ffffff9b179c3200\n --> error happens in usb_ep_enable().\n NCM: ncm_disable: ncm=ffffff9b179c3200\n --> no gether_disconnect() since ncm->port.in_ep->enabled is false.\n NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200\n NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm\n\n[function link via configfs]\n NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000\n NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000\n NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0\n usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm\n usb0: eth_start dev->port_usb=ffffff9b179c3200 <--\n eth_start_xmit()\n --> dev->wrap()\n Unable to handle kernel paging request at virtual address dead00000000014f\n\nThis patch addresses the issue by checking if 'ncm->netdev' is not NULL at\nncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'.\nIt's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect\nrather than check 'ncm->port.in_ep->enabled' since it might not be enabled\nbut the gether connection might be established.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26996" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0588bbbd718a8130b98c54518f1e0b569ce60a93", "url": "https://git.kernel.org/stable/c/0588bbbd718a8130b98c54518f1e0b569ce60a93" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6334b8e4553cc69f51e383c9de545082213d785e", "url": "https://git.kernel.org/stable/c/6334b8e4553cc69f51e383c9de545082213d785e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7250326cbb1f4f90391ac511a126b936cefb5bb7", "url": "https://git.kernel.org/stable/c/7250326cbb1f4f90391ac511a126b936cefb5bb7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f67c2020cb08499c400abf0fc32c65e4d9a09ca", "url": "https://git.kernel.org/stable/c/7f67c2020cb08499c400abf0fc32c65e4d9a09ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f356fd0cbd9c9cbd0854657a80d1608d0d732db3", "url": "https://git.kernel.org/stable/c/f356fd0cbd9c9cbd0854657a80d1608d0d732db3" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/" } ], "release_date": "2024-05-01T05:28:16Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-01T05:28:16Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64585", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: kill anchored URBs before freeing netdevs\n\nesd_usb_disconnect() frees each CAN netdev with free_candev() inside\nits per-netdev loop and only calls unlink_all_urbs(dev) afterwards.\nThe per-netdev private data (struct esd_usb_net_priv) is embedded in\nthe net_device allocation returned by alloc_candev(), so once\nfree_candev() has run, dev->nets[i] points to freed memory.\nunlink_all_urbs() then dereferences the freed dev->nets[i] to kill the\nper-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),\nclear active_tx_jobs, and reset priv->tx_contexts[].\n\nReorder the teardown so the anchored URBs are killed before the netdevs\nare freed, matching other CAN/USB drivers in the same directory such as\nems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then\nfree: unregister the netdevs first (which stops their TX queues), call\nunlink_all_urbs(dev) once, then free the netdevs.\n\nThis issue was found by an in-house static analysis tool.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64585" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e", "url": "https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c", "url": "https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e", "url": "https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9", "url": "https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d", "url": "https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264", "url": "https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d12f6add48f2da15c8c8281961d3faad804c76cf", "url": "https://git.kernel.org/stable/c/d12f6add48f2da15c8c8281961d3faad804c76cf" } ], "release_date": "2026-08-06T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-06T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52515", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52515" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc", "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a", "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206", "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5", "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb", "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb" } ], "release_date": "2024-03-02T21:52:25Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-03-02T21:52:25Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43206", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to potential privilege\nescalation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43206" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d", "url": "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940", "url": "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b", "url": "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed", "url": "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d", "url": "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b", "url": "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b", "url": "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f", "url": "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f" } ], "release_date": "2026-05-06T11:28:10Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T11:28:10Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50300", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix extent map use-after-free when handling missing device in read_one_chunk\n\nStore the error code before freeing the extent_map. Though it's\nreference counted structure, in that function it's the first and last\nallocation so this would lead to a potential use-after-free.\n\nThe error can happen eg. when chunk is stored on a missing device and\nthe degraded mount option is missing.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50300" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/169a4cf46882974d4db6d85eb623ec898e51bbc0", "url": "https://git.kernel.org/stable/c/169a4cf46882974d4db6d85eb623ec898e51bbc0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1742e1c90c3da344f3bb9b1f1309b3f47482756a", "url": "https://git.kernel.org/stable/c/1742e1c90c3da344f3bb9b1f1309b3f47482756a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8e7ed42bc3ca0d0e4191ee394d34962d3624c22", "url": "https://git.kernel.org/stable/c/b8e7ed42bc3ca0d0e4191ee394d34962d3624c22" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fce3713197ebba239e1c7e02174ed216ea1ee014", "url": "https://git.kernel.org/stable/c/fce3713197ebba239e1c7e02174ed216ea1ee014" } ], "release_date": "2025-09-15T14:45:55Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-15T14:45:55Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-49026", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ne100: Fix possible use after free in e100_xmit_prepare\n\nIn e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so\ne100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will\nresend the skb. But the skb is already freed, which will cause UAF bug\nwhen the upper layer resends the skb.\n\nRemove the harmful free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49026" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45605c75c52c7ae7bfe902214343aabcfe5ba0ff", "url": "https://git.kernel.org/stable/c/45605c75c52c7ae7bfe902214343aabcfe5ba0ff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fc27d22cdb9b1fcd754599d216a8992fed280cd", "url": "https://git.kernel.org/stable/c/9fc27d22cdb9b1fcd754599d216a8992fed280cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b46f6144ab89d3d757ead940759c505091626a7d", "url": "https://git.kernel.org/stable/c/b46f6144ab89d3d757ead940759c505091626a7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b775f37d943966f6f77dca402f5a9dedce502c25", "url": "https://git.kernel.org/stable/c/b775f37d943966f6f77dca402f5a9dedce502c25" } ], "release_date": "2024-10-21T20:06:31Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-10-21T20:06:31Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-51779", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-51779" }, { "category": "external", "summary": "https://github.com/torvalds/linux/commit/2e07e8348ea454615e268222ae3fc240421be768", "url": "https://github.com/torvalds/linux/commit/2e07e8348ea454615e268222ae3fc240421be768" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html" } ], "release_date": "2024-02-29T01:42:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-02-29T01:42:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64582", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct's kref is still at 1:\n\n list_del_init(&ip->pending_mmaps);\n spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */\n ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */\n [...]\n rxe_vma_open(vma); /* kref_get, ref → 2 */\n remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */\n vfree(ip->obj) /* clears vmalloc PTEs mid-walk */\n kfree(ip) /* frees rxe_mmap_info */\n\nThis yields:\n\n 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert\n\n 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n it. User VMA holds a PTE to a free'd page which might eventually get\n reallocated later by vmalloc which allows the attacker to get a clean\n page-level UAF.\n\n It is worth noting that even though a page-level UAF is possible given\n the strong primitive, it is statistically very difficult to achieve\n given the very short time window (after the last insert_page and before\n the kref_get).\n\nThe call trace are as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:validate_page_before_insert+0x32/0x300\n Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n Call Trace:\n \n insert_page+0x8f/0x190\n ? __pfx_insert_page+0x10/0x10\n ? kasan_save_alloc_info+0x38/0x60\n vm_insert_page+0x2e7/0x400\n remap_vmalloc_range_partial+0x212/0x3e0\n remap_vmalloc_range+0x6e/0xb0\n ? __kasan_check_write+0x14/0x30\n rxe_mmap+0x2e9/0x5d0\n ib_uverbs_mmap+0x1ad/0x2c0\n __mmap_region+0x12c2/0x2ad0\n ? __pfx___mmap_region+0x10/0x10\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_prev_slot+0x360/0x39c0\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_next_slot+0x1e5b/0x2f40\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n ? unmapped_area_topdown+0x4dd/0x610\n ? kfree+0x1b1/0x440\n ? free_cpumask_var+0x16/0x30\n ? __kasan_slab_free+0x7d/0xa0\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n mmap_region+0x2e6/0x3c0\n do_mmap+0xa3e/0x12a0\n ? __pfx_do_mmap+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? down_write_killable+0xba/0x160\n ? __pfx_down_write_killable+0x10/0x10\n ? __sanitizer_cov_trace_cmp4+0x16/0x30\n vm_mmap_pgoff+0x2d4/0x4a0\n ? __pfx_vm_mmap_pgoff+0x10/0x10\n ? fget+0x1bf/0x270\n ksys_mmap_pgoff+0x40c/0x690\n ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n ? __pfx_ksys_mmap_pgoff+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_trylock+0xbb/0x130\n ? __pfx__raw_spin_trylock+0x10/0x10\n __x64_sys_mmap+0x135/0x1e0\n x64_sys_c\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64582" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e", "url": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c", "url": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561", "url": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0", "url": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863", "url": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911", "url": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e", "url": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6", "url": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6" } ], "release_date": "2026-08-05T12:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-05T12:18:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43198", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet->pinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43198" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b", "url": "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae", "url": "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd", "url": "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30129", "url": "https://access.redhat.com/errata/RHSA-2026:30129" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33215", "url": "https://access.redhat.com/errata/RHSA-2026:33215" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33285", "url": "https://access.redhat.com/errata/RHSA-2026:33285" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:34094", "url": "https://access.redhat.com/errata/RHSA-2026:34094" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:34443", "url": "https://access.redhat.com/errata/RHSA-2026:34443" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35863", "url": "https://access.redhat.com/errata/RHSA-2026:35863" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35894", "url": "https://access.redhat.com/errata/RHSA-2026:35894" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35896", "url": "https://access.redhat.com/errata/RHSA-2026:35896" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35904", "url": "https://access.redhat.com/errata/RHSA-2026:35904" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36073", "url": "https://access.redhat.com/errata/RHSA-2026:36073" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36216", "url": "https://access.redhat.com/errata/RHSA-2026:36216" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36348", "url": "https://access.redhat.com/errata/RHSA-2026:36348" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36349", "url": "https://access.redhat.com/errata/RHSA-2026:36349" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41236", "url": "https://access.redhat.com/errata/RHSA-2026:41236" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-43198", "url": "https://access.redhat.com/security/cve/CVE-2026-43198" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2467228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467228" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json" } ], "release_date": "2026-05-06T11:28:05Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T11:28:05Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-49975", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't redirect packets with invalid pkt_len\n\nSyzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any\nskbs, that is, the flow->head is null.\nThe root cause, as the [2] says, is because that bpf_prog_test_run_skb()\nrun a bpf prog which redirects empty skbs.\nSo we should determine whether the length of the packet modified by bpf\nprog or others like bpf_prog_test is valid before forwarding it directly.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49975" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6204bf78b2a903b96ba43afff6abc0b04d6e0462", "url": "https://git.kernel.org/stable/c/6204bf78b2a903b96ba43afff6abc0b04d6e0462" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72f2dc8993f10262092745a88cb2dd0fef094f23", "url": "https://git.kernel.org/stable/c/72f2dc8993f10262092745a88cb2dd0fef094f23" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b68e53d56697a59b5c53893b53f508bbdf272a0", "url": "https://git.kernel.org/stable/c/8b68e53d56697a59b5c53893b53f508bbdf272a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a75987714bd2d8e59840667a28e15c1fa5c47554", "url": "https://git.kernel.org/stable/c/a75987714bd2d8e59840667a28e15c1fa5c47554" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd1894224407c484f652ad456e1ce423e89bb3eb", "url": "https://git.kernel.org/stable/c/fd1894224407c484f652ad456e1ce423e89bb3eb" } ], "release_date": "2025-06-18T11:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T11:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31494", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: use the current queue number for stats\n\nThere's a potential mismatch between the memory reserved for statistics\nand the amount of memory written.\n\ngem_get_sset_count() correctly computes the number of stats based on the\nactive queues, whereas gem_get_ethtool_stats() indiscriminately copies\ndata using the maximum number of queues, and in the case the number of\nactive queues is less than MACB_MAX_QUEUES, this results in a OOB write\nas observed in the KASAN splat.\n\n==================================================================\nBUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78\n [macb]\nWrite of size 760 at addr ffff80008080b000 by task ethtool/1027\n\nCPU: [...]\nTainted: [E]=UNSIGNED_MODULE\nHardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025\nCall trace:\n show_stack+0x20/0x38 (C)\n dump_stack_lvl+0x80/0xf8\n print_report+0x384/0x5e0\n kasan_report+0xa0/0xf0\n kasan_check_range+0xe8/0x190\n __asan_memcpy+0x54/0x98\n gem_get_ethtool_stats+0x54/0x78 [macb\n 926c13f3af83b0c6fe64badb21ec87d5e93fcf65]\n dev_ethtool+0x1220/0x38c0\n dev_ioctl+0x4ac/0xca8\n sock_do_ioctl+0x170/0x1d8\n sock_ioctl+0x484/0x5d8\n __arm64_sys_ioctl+0x12c/0x1b8\n invoke_syscall+0xd4/0x258\n el0_svc_common.constprop.0+0xb4/0x240\n do_el0_svc+0x48/0x68\n el0_svc+0x40/0xf8\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n\nThe buggy address belongs to a 1-page vmalloc region starting at\n 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff00000a333000 pfn:0xa333\nflags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)\nraw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000\nraw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\nFix it by making sure the copied size only considers the active number of\nqueues.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31494" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024", "url": "https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5", "url": "https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c", "url": "https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae", "url": "https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9", "url": "https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226", "url": "https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f", "url": "https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b", "url": "https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-04-22T13:54:16Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-22T13:54:16Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53130", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n\nomfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE),\nbut it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).\n\nLater, omfs_make_empty() uses\n\n sbi->s_sys_blocksize - OMFS_DIR_START\n\nas the length argument to memset(). Since s_sys_blocksize is u32,\na crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes\nan unsigned underflow there, wrapping to a value near 2^32. That drives\na ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel\nmemory far beyond the backing block buffer.\n\nAdd the corresponding lower-bound check alongside the existing upper-bound\ncheck in omfs_fill_super(), so that malformed images are rejected during\nsuperblock validation before any filesystem data is processed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53130" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14", "url": "https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51", "url": "https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3", "url": "https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6", "url": "https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07", "url": "https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644", "url": "https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03", "url": "https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54", "url": "https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54" } ], "release_date": "2026-06-24T16:30:57Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T16:30:57Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46209", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()\n\ndrm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions\nusing plain integer division:\n\n unsigned int width = mode_cmd->width / (i ? info->hsub : 1);\n unsigned int height = mode_cmd->height / (i ? info->vsub : 1);\n\nHowever, the ioctl-level framebuffer_check() in drm_framebuffer.c uses\ndrm_format_info_plane_width/height() which round up dimensions via\nDIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object\nsize check for certain pixel format and dimension combinations.\n\nFor example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the\nGEM size validation path sees height=0 instead of height=1. The\nexpression (height - 1) then wraps to UINT_MAX as an unsigned int,\ncausing min_size to overflow and wrap back to a small value. A tiny\nGEM object therefore passes the size guard, yet when the GPU accesses\nthe chroma plane it will read or write memory beyond the object's\nbounds.\n\nFix by replacing the open-coded divisions with drm_format_info_plane_width()\nand drm_format_info_plane_height(), which use DIV_ROUND_UP() and match\nthe calculation already used in framebuffer_check().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46209" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11427ad6c9f0def5ce567982b785da3191946430", "url": "https://git.kernel.org/stable/c/11427ad6c9f0def5ce567982b785da3191946430" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a17ea9861e89585361caa8bc231bd22dc6dbe7d", "url": "https://git.kernel.org/stable/c/1a17ea9861e89585361caa8bc231bd22dc6dbe7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1da4ab7189f1064b3b712b388772c008b4d82580", "url": "https://git.kernel.org/stable/c/1da4ab7189f1064b3b712b388772c008b4d82580" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22922f7dae74409fc4bf0f1142710cb6b8ce8cc2", "url": "https://git.kernel.org/stable/c/22922f7dae74409fc4bf0f1142710cb6b8ce8cc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d4c2268bd7243c3780fe32bf24ff876da272acf", "url": "https://git.kernel.org/stable/c/3d4c2268bd7243c3780fe32bf24ff876da272acf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b992591e04f2cce813bcf239b354f375bbf84d3", "url": "https://git.kernel.org/stable/c/6b992591e04f2cce813bcf239b354f375bbf84d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad", "url": "https://git.kernel.org/stable/c/adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5fc49d8470c5ebf3b41607600f277158f159950", "url": "https://git.kernel.org/stable/c/c5fc49d8470c5ebf3b41607600f277158f159950" } ], "release_date": "2026-05-28T09:40:27Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T09:40:27Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23204", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23204" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5", "url": "https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c", "url": "https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136", "url": "https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943", "url": "https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8", "url": "https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7", "url": "https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5", "url": "https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-02-14T16:27:27Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-14T16:27:27Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64593", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not trim a device which is not writeable\n\n[BUG]\nThere is a bug report that btrfs/242 can randomly fail with the\nfollowing NULL pointer dereference:\n\n run fstests btrfs/242 at 2026-06-01 10:25:08\n BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)\n BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874\n BTRFS info (device sdc): using crc32c checksum algorithm\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS info (device sdc): allowing degraded mounts\n BTRFS info (device sdc): turning on async discard\n BTRFS info (device sdc): enabling free space tree\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000\n CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025\n pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]\n lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]\n Call trace:\n btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)\n btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n __arm64_sys_ioctl+0xac/0x108\n invoke_syscall.constprop.0+0x5c/0xd0\n el0_svc_common.constprop.0+0x40/0xf0\n do_el0_svc+0x24/0x40\n el0_svc+0x40/0x1d0\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)\n ---[ end trace 0000000000000000 ]---\n\nAlso the reporter is very kind to test the following ASSERT() added to\nbtrfs_trim_free_extents_throttle():\n\n\tASSERT(device->bdev,\n\t \"devid=%llu path=%s dev_state=0x%lx\\n\",\n\t device->devid, btrfs_dev_name(device), device->dev_state);\n\nAnd it shows the following output:\n\n assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)\n\nWhich means the device->bdev is NULL, and the dev_state is\nBTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without\nBTRFS_DEV_STATE_WRITEABLE flag set.\n\n[CAUSE]\nThe pc points to the following call chain:\n\n btrfs_trim_fs()\n |- btrfs_trim_free_extents()\n |- btrfs_trim_free_extents_throttle()\n |- bdev_max_discard_sectors(device->bdev)\n\nSo the NULL pointer dereference is caused by device->bdev being NULL.\n\nThis looks impossible by a quick glance, as just before calling\nbtrfs_trim_free_extents_throttle(), we have skipped any device that has\nBTRFS_DEV_STATE_MISSING flag set.\n\nHowever in this particular case, there is a window where the missing\ndevice is later re-scanned, causing btrfs to remove the\nBTRFS_DEV_STATE_MISSING flag:\n\n btrfs_control_ioctl()\n |- btrfs_scan_one_device()\n |- device_list_add()\n |- rcu_assign_pointer(device->name, name);\n | This updates the missing device's path to the new good path.\n |\n |- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)\n This removes the BTRFS_DEV_STATE_MISSING flag.\n\nThis allows the missing device to re-appear and clear the\nBTRFS_DEV_STATE_MISSING flag. However the device still does not have\nthe BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.\n\nThe bdev pointer remains NULL, triggering the crash later.\n\n[FIX]\nThis is a big de-synchronization between BTRFS_DEV_STATE_MISSING and\ndevice->bdev pointer, and shows a gap in btrfs's re-appearing-device\nhandling.\n\nThe proper handling of re-appearing device will need quite some extra\nwork, which is out of the context of this small\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64593" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3", "url": "https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc", "url": "https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226", "url": "https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05", "url": "https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd", "url": "https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e", "url": "https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b", "url": "https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251", "url": "https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251" } ], "release_date": "2026-08-06T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-06T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39702", "cwe": { "id": "CWE-203", "name": "Observable Discrepancy" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39702" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0", "url": "https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3", "url": "https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831", "url": "https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa", "url": "https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7", "url": "https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a", "url": "https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884", "url": "https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-05T17:21:08Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-05T17:21:08Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23388", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \"general protection fault in squashfs_copy_data\"\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata. This will trap this and other cases.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23388" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3", "url": "https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713", "url": "https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2", "url": "https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013", "url": "https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5", "url": "https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383", "url": "https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c", "url": "https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d", "url": "https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d" } ], "release_date": "2026-03-25T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-25T11:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43279", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn't fix the root cause of the playback error\nitself, but this merely covers the kernel Oops.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43279" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a", "url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa", "url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049", "url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435", "url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f", "url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948", "url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e", "url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e" } ], "release_date": "2026-05-06T11:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T11:29:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-49720", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix handling of offline queues in blk_mq_alloc_request_hctx()\n\nThis patch prevents that test nvme/004 triggers the following:\n\nUBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9\nindex 512 is out of range for type 'long unsigned int [512]'\nCall Trace:\n show_stack+0x52/0x58\n dump_stack_lvl+0x49/0x5e\n dump_stack+0x10/0x12\n ubsan_epilogue+0x9/0x3b\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\n blk_mq_alloc_request_hctx+0x304/0x310\n __nvme_submit_sync_cmd+0x70/0x200 [nvme_core]\n nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics]\n nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop]\n nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop]\n nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics]\n nvmf_dev_write+0xae/0x111 [nvme_fabrics]\n vfs_write+0x144/0x560\n ksys_write+0xb7/0x140\n __x64_sys_write+0x42/0x50\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49720" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14dc7a18abbe4176f5626c13c333670da8e06aa1", "url": "https://git.kernel.org/stable/c/14dc7a18abbe4176f5626c13c333670da8e06aa1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7fa28a7c3d74933a4fc22d341b60927952f31c19", "url": "https://git.kernel.org/stable/c/7fa28a7c3d74933a4fc22d341b60927952f31c19" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b202a0bd2580ee5b0453772c46d464152fafff73", "url": "https://git.kernel.org/stable/c/b202a0bd2580ee5b0453772c46d464152fafff73" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5e65ef044d627effdc2599040b6d204e003f955", "url": "https://git.kernel.org/stable/c/b5e65ef044d627effdc2599040b6d204e003f955" } ], "release_date": "2025-02-26T07:01:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-02-26T07:01:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39853", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix potential invalid access when MAC list is empty\n\nlist_first_entry() never returns NULL - if the list is empty, it still\nreturns a pointer to an invalid object, leading to potential invalid\nmemory access when dereferenced.\n\nFix this by using list_first_entry_or_null instead of list_first_entry.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39853" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd", "url": "https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d", "url": "https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf", "url": "https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b", "url": "https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8", "url": "https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a556f06338e1d5a85af0e32ecb46e365547f92b9", "url": "https://git.kernel.org/stable/c/a556f06338e1d5a85af0e32ecb46e365547f92b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2a5e74879f9b494bbd66fa93f355feacde450c7", "url": "https://git.kernel.org/stable/c/e2a5e74879f9b494bbd66fa93f355feacde450c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb216d980fae6561c7c70af8ef826faf059c6515", "url": "https://git.kernel.org/stable/c/fb216d980fae6561c7c70af8ef826faf059c6515" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" } ], "release_date": "2025-09-19T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-19T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43494", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm->data.op_mmp_znotifier is cleared. But we fail to properly\nclear rm->data.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43494" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113", "url": "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353", "url": "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479", "url": "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51", "url": "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799", "url": "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa", "url": "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6", "url": "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4", "url": "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4" }, { "category": "external", "summary": "https://github.com/v12-security/pocs/tree/main/pintheft", "url": "https://github.com/v12-security/pocs/tree/main/pintheft" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/21/2", "url": "http://www.openwall.com/lists/oss-security/2026/05/21/2" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-43494", "url": "https://access.redhat.com/security/cve/CVE-2026-43494" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2480434", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480434" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json" } ], "release_date": "2026-05-21T10:49:21Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-21T10:49:21Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56593", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()\n\nThis patch fixes a NULL pointer dereference bug in brcmfmac that occurs\nwhen a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs\nare sent from the pkt queue.\n\nThe problem is the number of entries in the pre-allocated sgtable, it is\nnents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1.\nGiven the default [rt]xglom_size=32 it's actually 35 which is too small.\nWorst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB\nis added for each original SKB if tailroom isn't enough to hold tail_pad.\nAt least one sg entry is needed for each SKB. So, eventually the \"skb_queue_walk loop\"\nin brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return\nNULL and this causes the oops.\n\nThe patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle\nthe worst-case.\nBtw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464\nadditional bytes of memory.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56593" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07c020c6d14d29e5a3ea4e4576b8ecf956a80834", "url": "https://git.kernel.org/stable/c/07c020c6d14d29e5a3ea4e4576b8ecf956a80834" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/342f87d263462c2670b77ea9a32074cab2ac6fa1", "url": "https://git.kernel.org/stable/c/342f87d263462c2670b77ea9a32074cab2ac6fa1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34941321b516bd7c6103bd01287d71a1804d19d3", "url": "https://git.kernel.org/stable/c/34941321b516bd7c6103bd01287d71a1804d19d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67a25ea28f8ec1da8894f2f115d01d3becf67dc7", "url": "https://git.kernel.org/stable/c/67a25ea28f8ec1da8894f2f115d01d3becf67dc7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7522d7d745d13fbeff3350fe6aa56c8dae263571", "url": "https://git.kernel.org/stable/c/7522d7d745d13fbeff3350fe6aa56c8dae263571" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/857282b819cbaa0675aaab1e7542e2c0579f52d7", "url": "https://git.kernel.org/stable/c/857282b819cbaa0675aaab1e7542e2c0579f52d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dfb3f9d3f602602de208da7bdcc0f6d5ee74af68", "url": "https://git.kernel.org/stable/c/dfb3f9d3f602602de208da7bdcc0f6d5ee74af68" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T15:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-31399", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31399" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c", "url": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "url": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c", "url": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "url": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348", "url": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326", "url": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163", "url": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "url": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e" } ], "release_date": "2026-04-03T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-03T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56606", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56606" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21", "url": "https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0", "url": "https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7", "url": "https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b", "url": "https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f", "url": "https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414", "url": "https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829", "url": "https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T14:51:11Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T14:51:11Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53282", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write\n\nDuring the sysfs firmware write process, a use-after-free read warning is\nlogged from the lpfc_wr_object() routine:\n\n BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]\n Use-after-free read at 0x0000000000cf164d (in kfence-#111):\n lpfc_wr_object+0x235/0x310 [lpfc]\n lpfc_write_firmware.cold+0x206/0x30d [lpfc]\n lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]\n lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]\n kernfs_fop_write_iter+0x121/0x1b0\n new_sync_write+0x11c/0x1b0\n vfs_write+0x1ef/0x280\n ksys_write+0x5f/0xe0\n do_syscall_64+0x59/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe driver accessed wr_object pointer data, which was initialized into\nmailbox payload memory, after the mailbox object was released back to the\nmailbox pool.\n\nFix by moving the mailbox free calls to the end of the routine ensuring\nthat we don't reference internal mailbox memory after release.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53282" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/21681b81b9ae548c5dae7ae00d931197a27f480c", "url": "https://git.kernel.org/stable/c/21681b81b9ae548c5dae7ae00d931197a27f480c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc", "url": "https://git.kernel.org/stable/c/51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8becb97918f04bb177bc9c4e00c2bdb302e00944", "url": "https://git.kernel.org/stable/c/8becb97918f04bb177bc9c4e00c2bdb302e00944" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8dfefa8f424ab208e552df1bfd008b732f3d0ad1", "url": "https://git.kernel.org/stable/c/8dfefa8f424ab208e552df1bfd008b732f3d0ad1" } ], "release_date": "2025-09-16T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T08:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37839", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: remove wrong sb->s_sequence check\n\nJournal emptiness is not determined by sb->s_sequence == 0 but rather by\nsb->s_start == 0 (which is set a few lines above). Furthermore 0 is a\nvalid transaction ID so the check can spuriously trigger. Remove the\ninvalid WARN_ON.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37839" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b4643ffaf72d7a5a357e9bf68b1775f8cfe7e77", "url": "https://git.kernel.org/stable/c/3b4643ffaf72d7a5a357e9bf68b1775f8cfe7e77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9eaec071f111cd2124ce9a5b93536d3f6837d457", "url": "https://git.kernel.org/stable/c/9eaec071f111cd2124ce9a5b93536d3f6837d457" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad926f735b4d4f10768fec7d080cadeb6d075cac", "url": "https://git.kernel.org/stable/c/ad926f735b4d4f10768fec7d080cadeb6d075cac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0cca357f85beb6144ab60c62dcc98508cc044bf", "url": "https://git.kernel.org/stable/c/b0cca357f85beb6144ab60c62dcc98508cc044bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b479839525fe7906966cdc4b5b2afbca048558a1", "url": "https://git.kernel.org/stable/c/b479839525fe7906966cdc4b5b2afbca048558a1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c88f7328bb0fff66520fc9164f02b1d06e083c1b", "url": "https://git.kernel.org/stable/c/c88f7328bb0fff66520fc9164f02b1d06e083c1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c98eb9ffb1d9c98237b5e1668eee17654e129fb0", "url": "https://git.kernel.org/stable/c/c98eb9ffb1d9c98237b5e1668eee17654e129fb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf30432f5b3064ff85d85639c2f0106f89c566f6", "url": "https://git.kernel.org/stable/c/cf30432f5b3064ff85d85639c2f0106f89c566f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6eff39dd0fe4190c6146069cc16d160e71d1148", "url": "https://git.kernel.org/stable/c/e6eff39dd0fe4190c6146069cc16d160e71d1148" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-09T07:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-09T07:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-53239", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: Release resources at card release\n\nThe current 6fire code tries to release the resources right after the\ncall of usb6fire_chip_abort(). But at this moment, the card object\nmight be still in use (as we're calling snd_card_free_when_closed()).\n\nFor avoid potential UAFs, move the release of resources to the card's\nprivate_free instead of the manual call of usb6fire_chip_destroy() at\nthe USB disconnect callback.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-53239" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0df7f4b5cc10f5adf98be0845372e9eef7bb5b09", "url": "https://git.kernel.org/stable/c/0df7f4b5cc10f5adf98be0845372e9eef7bb5b09" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/273eec23467dfbfbd0e4c10302579ba441fb1e13", "url": "https://git.kernel.org/stable/c/273eec23467dfbfbd0e4c10302579ba441fb1e13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57860a80f03f9dc69a34a5c37b0941ad032a0a8c", "url": "https://git.kernel.org/stable/c/57860a80f03f9dc69a34a5c37b0941ad032a0a8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74357d0b5cd3ef544752bc9f21cbeee4902fae6c", "url": "https://git.kernel.org/stable/c/74357d0b5cd3ef544752bc9f21cbeee4902fae6c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0810c3d6dd2d29a9b92604d682eacd2902ce947", "url": "https://git.kernel.org/stable/c/a0810c3d6dd2d29a9b92604d682eacd2902ce947" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b754e831a94f82f2593af806741392903f359168", "url": "https://git.kernel.org/stable/c/b754e831a94f82f2593af806741392903f359168" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b889a7d68d7e76b8795b754a75c91a2d561d5e8c", "url": "https://git.kernel.org/stable/c/b889a7d68d7e76b8795b754a75c91a2d561d5e8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea8cc56db659cf0ae57073e32a4735ead7bd7ee3", "url": "https://git.kernel.org/stable/c/ea8cc56db659cf0ae57073e32a4735ead7bd7ee3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f2d06d4e129e2508e356136f99bb20a332ff1a00", "url": "https://git.kernel.org/stable/c/f2d06d4e129e2508e356136f99bb20a332ff1a00" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T13:50:24Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T13:50:24Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43450", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb->args[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb->args[1] is never cleared. The for loop finishes with\ncb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe 'goto restart' block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb->args[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43450" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c", "url": "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf", "url": "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e", "url": "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da", "url": "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db", "url": "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89", "url": "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4", "url": "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30", "url": "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30" } ], "release_date": "2026-05-08T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-08T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-26828", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need. However,\nthe problem is that \"bytes_left\" is type ssize_t while sizeof() is type\nsize_t. That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26828" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512", "url": "https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204", "url": "https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301", "url": "https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308", "url": "https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308" } ], "release_date": "2024-04-17T10:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-04-17T10:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-46022", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46022" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841", "url": "https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9", "url": "https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107", "url": "https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84", "url": "https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0", "url": "https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865", "url": "https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab", "url": "https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b", "url": "https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-27T14:17:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-21858", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: Fix use-after-free in geneve_find_dev().\n\nsyzkaller reported a use-after-free in geneve_find_dev() [0]\nwithout repro.\n\ngeneve_configure() links struct geneve_dev.next to\nnet_generic(net, geneve_net_id)->geneve_list.\n\nThe net here could differ from dev_net(dev) if IFLA_NET_NS_PID,\nIFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set.\n\nWhen dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally\ncalls unregister_netdevice_queue() for each dev in the netns,\nand later the dev is freed.\n\nHowever, its geneve_dev.next is still linked to the backend UDP\nsocket netns.\n\nThen, use-after-free will occur when another geneve dev is created\nin the netns.\n\nLet's call geneve_dellink() instead in geneve_destroy_tunnels().\n\n[0]:\nBUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline]\nBUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\nRead of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441\n\nCPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d\nHardware name: linux,dummy-virt (DT)\nCall trace:\n show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x16c/0x6f0 mm/kasan/report.c:489\n kasan_report+0xc0/0x120 mm/kasan/report.c:602\n __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379\n geneve_find_dev drivers/net/geneve.c:1295 [inline]\n geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\n geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634\n rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892\n sock_sendmsg_nosec net/socket.c:713 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568\n ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622\n __sys_sendmsg net/socket.c:2654 [inline]\n __do_sys_sendmsg net/socket.c:2659 [inline]\n __se_sys_sendmsg net/socket.c:2657 [inline]\n __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151\n el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600\n\nAllocated by task 13247:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x30/0x68 mm/kasan/common.c:68\n kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4298 [inline]\n __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304\n __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645\n alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470\n rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604\n rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_n\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-21858" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ce92ca990cfac88a87c61df3cc0b5880e688ecf", "url": "https://git.kernel.org/stable/c/3ce92ca990cfac88a87c61df3cc0b5880e688ecf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a0538ac6826807d6919f6aecbb8996c2865af2c", "url": "https://git.kernel.org/stable/c/5a0538ac6826807d6919f6aecbb8996c2865af2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/788dbca056a8783ec063da3c9d49a3a71c76c283", "url": "https://git.kernel.org/stable/c/788dbca056a8783ec063da3c9d49a3a71c76c283" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/904e746b2e7fa952ab8801b303ce826a63153d78", "url": "https://git.kernel.org/stable/c/904e746b2e7fa952ab8801b303ce826a63153d78" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9593172d93b9f91c362baec4643003dc29802929", "url": "https://git.kernel.org/stable/c/9593172d93b9f91c362baec4643003dc29802929" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d5e86e27de0936f3cb0a299ce519d993e9cf3886", "url": "https://git.kernel.org/stable/c/d5e86e27de0936f3cb0a299ce519d993e9cf3886" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da9b0ae47f084014b1e4b3f31f70a0defd047ff3", "url": "https://git.kernel.org/stable/c/da9b0ae47f084014b1e4b3f31f70a0defd047ff3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f74f6560146714241c6e167b03165ee77a86e316", "url": "https://git.kernel.org/stable/c/f74f6560146714241c6e167b03165ee77a86e316" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2025-03-12T09:42:11Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-03-12T09:42:11Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38729", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Validate UAC3 power domain descriptors, too\n\nUAC3 power domain descriptors need to be verified with its variable\nbLength for avoiding the unexpected OOB accesses by malicious\nfirmware, too.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38729" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc", "url": "https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81", "url": "https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a", "url": "https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7", "url": "https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd", "url": "https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61a", "url": "https://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595f", "url": "https://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac", "url": "https://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0d", "url": "https://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0d" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-04T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-04T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31602", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Limit PTP to a single page\n\nCommit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256\nplayback streams, but the additional pages are not used by the card\ncorrectly. The CT20K2 hardware already has multiple VMEM_PTPAL\nregisters, but using them separately would require refactoring the\nentire virtual memory allocation logic.\n\nct_vm_map() always uses PTEs in vm->ptp[0].area regardless of\nCT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When\naggregate memory allocations exceed this limit, ct_vm_map() tries to\naccess beyond the allocated space and causes a page fault:\n\n BUG: unable to handle page fault for address: ffffd4ae8a10a000\n Oops: Oops: 0002 [#1] SMP PTI\n RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]\n Call Trace:\n atc_pcm_playback_prepare+0x225/0x3b0\n ct_pcm_playback_prepare+0x38/0x60\n snd_pcm_do_prepare+0x2f/0x50\n snd_pcm_action_single+0x36/0x90\n snd_pcm_action_nonatomic+0xbf/0xd0\n snd_pcm_ioctl+0x28/0x40\n __x64_sys_ioctl+0x97/0xe0\n do_syscall_64+0x81/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRevert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count\nremain unchanged.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31602" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578", "url": "https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29", "url": "https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5", "url": "https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f", "url": "https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47", "url": "https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e", "url": "https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933", "url": "https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42ee", "url": "https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94eb", "url": "https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94eb" } ], "release_date": "2026-04-24T14:42:25Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:25Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-39197", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39197" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2023-39197", "url": "https://access.redhat.com/security/cve/CVE-2023-39197" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2218342", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218342" } ], "release_date": "2024-01-23T03:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-01-23T03:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23407", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] >= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[ 57.179855] ==================================================================\n[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 57.181563] Call Trace:\n[ 57.181572] \n[ 57.181577] dump_stack_lvl+0x5e/0x80\n[ 57.181596] print_report+0xc8/0x270\n[ 57.181605] ? verify_dfa+0x59a/0x660\n[ 57.181608] kasan_report+0x118/0x150\n[ 57.181620] ? verify_dfa+0x59a/0x660\n[ 57.181623] verify_dfa+0x59a/0x660\n[ 57.181627] aa_dfa_unpack+0x1610/0x1740\n[ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470\n[ 57.181640] unpack_pdb+0x86d/0x46b0\n[ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181656] ? aa_unpack_nameX+0x1a8/0x300\n[ 57.181659] aa_unpack+0x20b0/0x4c30\n[ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181664] ? stack_depot_save_flags+0x33/0x700\n[ 57.181681] ? kasan_save_track+0x4f/0x80\n[ 57.181683] ? kasan_save_track+0x3e/0x80\n[ 57.181686] ? __kasan_kmalloc+0x93/0xb0\n[ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130\n[ 57.181697] ? policy_update+0x154/0x330\n[ 57.181704] aa_replace_profiles+0x15a/0x1dd0\n[ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181712] ? aa_loaddata_alloc+0x77/0x140\n[ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181717] ? _copy_from_user+0x2a/0x70\n[ 57.181730] policy_update+0x17a/0x330\n[ 57.181733] profile_replace+0x153/0x1a0\n[ 57.181735] ? rw_verify_area+0x93/0x2d0\n[ 57.181740] vfs_write+0x235/0xab0\n[ 57.181745] ksys_write+0xb0/0x170\n[ 57.181748] do_syscall_64+0x8e/0x660\n[ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23407" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec", "url": "https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f", "url": "https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc", "url": "https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831", "url": "https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4", "url": "https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c", "url": "https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4", "url": "https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed", "url": "https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed" } ], "release_date": "2026-04-01T08:36:37Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-01T08:36:37Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31396", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix use-after-free access to PTP clock\n\nPTP clock is registered on every opening of the interface and destroyed on\nevery closing. However it may be accessed via get_ts_info ethtool call\nwhich is possible while the interface is just present in the kernel.\n\nBUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426\nRead of size 4 at addr ffff8880194345cc by task syz.0.6/948\n\nCPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:316 [inline]\n print_report+0x17f/0x496 mm/kasan/report.c:420\n kasan_report+0xd9/0x180 mm/kasan/report.c:524\n ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426\n gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349\n macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371\n __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558\n ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline]\n __dev_ethtool net/ethtool/ioctl.c:3017 [inline]\n dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095\n dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510\n sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215\n sock_ioctl+0x577/0x6d0 net/socket.c:1320\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:46 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \n\nAllocated by task 457:\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:699 [inline]\n ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235\n gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375\n macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920\n __dev_open+0x2ce/0x500 net/core/dev.c:1501\n __dev_change_flags+0x56a/0x740 net/core/dev.c:8651\n dev_change_flags+0x92/0x170 net/core/dev.c:8722\n do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833\n __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608\n rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655\n rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150\n netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872\n sock_sendmsg_nosec net/socket.c:718 [inline]\n __sock_sendmsg+0x14b/0x180 net/socket.c:730\n __sys_sendto+0x320/0x3b0 net/socket.c:2152\n __do_sys_sendto net/socket.c:2164 [inline]\n __se_sys_sendto net/socket.c:2160 [inline]\n __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160\n do_syscall_x64 arch/x86/entry/common.c:46 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 938:\n kasan_slab_free include/linux/kasan.h:177 [inline]\n slab_free_hook mm/slub.c:1729 [inline]\n slab_free_freelist_hook mm/slub.c:1755 [inline]\n slab_free mm/slub.c:3687 [inline]\n __kmem_cache_free+0xbc/0x320 mm/slub.c:3700\n device_release+0xa0/0x240 drivers/base/core.c:2507\n kobject_cleanup lib/kobject.c:681 [inline]\n kobject_release lib/kobject.c:712 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x1cd/0x350 lib/kobject.c:729\n put_device+0x1b/0x30 drivers/base/core.c:3805\n ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391\n gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404\n macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966\n __dev_close_many+0x1b9/0x310 net/core/dev.c:1585\n __dev_close net/core/dev.c:1597 [inline]\n __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649\n dev_change_fl\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31396" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0bb848d8c64938024e45780f8032f1f67d3a3607", "url": "https://git.kernel.org/stable/c/0bb848d8c64938024e45780f8032f1f67d3a3607" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f4714065b2bcbb0a4013fd355b84b848e6cc345", "url": "https://git.kernel.org/stable/c/1f4714065b2bcbb0a4013fd355b84b848e6cc345" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/341d01087f821aa0f165fb1ffc8bfe4e50776da7", "url": "https://git.kernel.org/stable/c/341d01087f821aa0f165fb1ffc8bfe4e50776da7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5653af416a48f6c18f9626ae9df96f814f45ff34", "url": "https://git.kernel.org/stable/c/5653af416a48f6c18f9626ae9df96f814f45ff34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b757f345eeea87ed5d8afd6de35b927a1a57a2f", "url": "https://git.kernel.org/stable/c/6b757f345eeea87ed5d8afd6de35b927a1a57a2f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8820ffe0975fd2efbe50453e9179c8e1c33a13d3", "url": "https://git.kernel.org/stable/c/8820ffe0975fd2efbe50453e9179c8e1c33a13d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8da13e6d63c1a97f7302d342c89c4a56a55c7015", "url": "https://git.kernel.org/stable/c/8da13e6d63c1a97f7302d342c89c4a56a55c7015" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb652535e9ec795ef5c1078f7578eaaed755268b", "url": "https://git.kernel.org/stable/c/eb652535e9ec795ef5c1078f7578eaaed755268b" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-04-03T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-03T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31622", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: Bounds check NFC-A cascade depth in SDD response handler\n\nThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3\nor 4 bytes to target->nfcid1 on each round, but the number of cascade\nrounds is controlled entirely by the peer device. The peer sets the\ncascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the\ncascade-incomplete bit in the SEL_RES (deciding whether another round\nfollows).\n\nISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is\nsized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver\nactually enforces this. This means a malicious peer can keep the\ncascade running, writing past the heap-allocated nfc_target with each\nround.\n\nFix this by rejecting the response when the accumulated UID would exceed\nthe buffer.\n\nCommit e329e71013c9 (\"NFC: nci: Bounds check struct nfc_target arrays\")\nfixed similar missing checks against the same field on the NCI path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31622" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc", "url": "https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387", "url": "https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a", "url": "https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1", "url": "https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1", "url": "https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba", "url": "https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3", "url": "https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb", "url": "https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef", "url": "https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef" } ], "release_date": "2026-04-24T14:42:39Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:39Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31747", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31747" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655", "url": "https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7", "url": "https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2", "url": "https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6", "url": "https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5", "url": "https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d", "url": "https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38", "url": "https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561", "url": "https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-22022", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\n\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\nbug, one without) were seen to cause IOMMU faults after some Missed\nService Errors. Faulting address is immediately after a transfer ring\nsegment and patched dynamic debug messages revealed that the MSE was\nreceived when waiting for a TD near the end of that segment:\n\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\n\nIt gets even funnier if the next page is a ring segment accessible to\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\n\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n\nAt some point completion events change from Isoch Buffer Overrun to\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\n\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\n\nIt's possible that data from the isochronous device were written to\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\nother devices or even other HCs in the same IOMMU domain.\n\nLastly, an error from a different USB device on another HC. Was it\ncaused by the above? I don't know, but it may have been. The disk\nwas working without any other issues and generated PCIe traffic to\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\nshared one x1 slot by means of a commercial \"PCIe splitter\" board.\n\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\n\nFortunately, it appears that this ridiculous bug is avoided by setting\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\nknown which also expect the bit to be set and they ignore Link TRBs if\nit's not. Reportedly, 0.95 spec guaranteed that the bit is set.\n\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\ntens of MSEs per second and runs into the bug within seconds. Chaining\nLink TRBs allows the same workload to run for many minutes, many times.\n\nNo ne\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22022" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1d", "url": "https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6ca", "url": "https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595", "url": "https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1a", "url": "https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21", "url": "https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2e", "url": "https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01", "url": "https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781c", "url": "https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781c" } ], "release_date": "2025-04-16T10:23:27Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-04-16T10:23:27Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38103", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()\n\nUpdate struct hid_descriptor to better reflect the mandatory and\noptional parts of the HID Descriptor as per USB HID 1.11 specification.\nNote: the kernel currently does not parse any optional HID class\ndescriptors, only the mandatory report descriptor.\n\nUpdate all references to member element desc[0] to rpt_desc.\n\nAdd test to verify bLength and bNumDescriptors values are valid.\n\nReplace the for loop with direct access to the mandatory HID class\ndescriptor member for the report descriptor. This eliminates the\npossibility of getting an out-of-bounds fault.\n\nAdd a warning message if the HID descriptor contains any unsupported\noptional HID class descriptors.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38103" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1df80d748f984290c895e843401824215dcfbfb0", "url": "https://git.kernel.org/stable/c/1df80d748f984290c895e843401824215dcfbfb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41827a2dbdd7880df9881506dee13bc88d4230bb", "url": "https://git.kernel.org/stable/c/41827a2dbdd7880df9881506dee13bc88d4230bb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/485e1b741eb838cbe1d6b0e81e5ab62ae6c095cf", "url": "https://git.kernel.org/stable/c/485e1b741eb838cbe1d6b0e81e5ab62ae6c095cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4fa7831cf0ac71a0a345369d1a6084f2b096e55e", "url": "https://git.kernel.org/stable/c/4fa7831cf0ac71a0a345369d1a6084f2b096e55e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74388368927e9c52a69524af5bbd6c55eb4690de", "url": "https://git.kernel.org/stable/c/74388368927e9c52a69524af5bbd6c55eb4690de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a6d6b68db128da2078ccd9a751dfa3f75c9cf5b", "url": "https://git.kernel.org/stable/c/7a6d6b68db128da2078ccd9a751dfa3f75c9cf5b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8f842534807985d3a676006d140541b87044345", "url": "https://git.kernel.org/stable/c/a8f842534807985d3a676006d140541b87044345" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe7f7ac8e0c708446ff017453add769ffc15deed", "url": "https://git.kernel.org/stable/c/fe7f7ac8e0c708446ff017453add769ffc15deed" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-03T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-03T09:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39817", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Fix slab-out-of-bounds in efivarfs_d_compare\n\nObserved on kernel 6.6 (present on master as well):\n\n BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0\n Call trace:\n kasan_check_range+0xe8/0x190\n __asan_loadN+0x1c/0x28\n memcmp+0x98/0xd0\n efivarfs_d_compare+0x68/0xd8\n __d_lookup_rcu_op_compare+0x178/0x218\n __d_lookup_rcu+0x1f8/0x228\n d_alloc_parallel+0x150/0x648\n lookup_open.isra.0+0x5f0/0x8d0\n open_last_lookups+0x264/0x828\n path_openat+0x130/0x3f8\n do_filp_open+0x114/0x248\n do_sys_openat2+0x340/0x3c0\n __arm64_sys_openat+0x120/0x1a0\n\nIf dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become\nnegative, leadings to oob. The issue can be triggered by parallel\nlookups using invalid filename:\n\n T1\t\t\tT2\n lookup_open\n ->lookup\n simple_lookup\n d_add\n // invalid dentry is added to hash list\n\n\t\t\tlookup_open\n\t\t\t d_alloc_parallel\n\t\t\t __d_lookup_rcu\n\t\t\t __d_lookup_rcu_op_compare\n\t\t\t hlist_bl_for_each_entry_rcu\n\t\t\t // invalid dentry can be retrieved\n\t\t\t ->d_compare\n\t\t\t efivarfs_d_compare\n\t\t\t // oob\n\nFix it by checking 'guid' before cmp.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39817" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6", "url": "https://git.kernel.org/stable/c/0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/568e7761279b99c6daa3002290fd6d8047ddb6d2", "url": "https://git.kernel.org/stable/c/568e7761279b99c6daa3002290fd6d8047ddb6d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71581a82f38e5a4d807d71fc1bb59aead80ccf95", "url": "https://git.kernel.org/stable/c/71581a82f38e5a4d807d71fc1bb59aead80ccf95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/794399019301944fd6d2e0d7a51b3327e26c410e", "url": "https://git.kernel.org/stable/c/794399019301944fd6d2e0d7a51b3327e26c410e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/925599eba46045930b850a98ae594d2e3028ac40", "url": "https://git.kernel.org/stable/c/925599eba46045930b850a98ae594d2e3028ac40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a6358f8cf64850f3f27857b8ed8c1b08cfc4685c", "url": "https://git.kernel.org/stable/c/a6358f8cf64850f3f27857b8ed8c1b08cfc4685c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2925cd6207079c3f4d040d082515db78d63afbf", "url": "https://git.kernel.org/stable/c/c2925cd6207079c3f4d040d082515db78d63afbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7f5e35e70507d10cbaff5f9e194ed54c4ee14f7", "url": "https://git.kernel.org/stable/c/d7f5e35e70507d10cbaff5f9e194ed54c4ee14f7" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-16T13:00:17Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T13:00:17Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56650", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n \n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56650" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7", "url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2", "url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800", "url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3", "url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe", "url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09", "url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4", "url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T15:02:50Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T15:02:50Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37882", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix isochronous Ring Underrun/Overrun event handling\n\nThe TRB pointer of these events points at enqueue at the time of error\noccurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we\nare handling the event, a new TD may be queued at this ring position.\n\nI can trigger this race by rising interrupt moderation to increase IRQ\nhandling delay. Similar delay may occur naturally due to system load.\n\nIf this ever happens after a Missed Service Error, missed TDs will be\nskipped and the new TD processed as if it matched the event. It could\nbe given back prematurely, risking data loss or buffer UAF by the xHC.\n\nDon't complete TDs on xrun events and don't warn if queued TDs don't\nmatch the event's TRB pointer, which can be NULL or a link/no-op TRB.\nDon't warn if there are no queued TDs at all.\n\nNow that it's safe, also handle xrun events if the skip flag is clear.\nThis ensures completion of any TD stuck in 'error mid TD' state right\nbefore the xrun event, which could happen if a driver submits a finite\nnumber of URBs to a buggy HC and then an error occurs on the last TD.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37882" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/16a7a8e6c47fea5c847beb696c8c21a7a44c1915", "url": "https://git.kernel.org/stable/c/16a7a8e6c47fea5c847beb696c8c21a7a44c1915" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/39a080a2925c81b0f1da0add44722ef2b78e5454", "url": "https://git.kernel.org/stable/c/39a080a2925c81b0f1da0add44722ef2b78e5454" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/906dec15b9b321b546fd31a3c99ffc13724c7af4", "url": "https://git.kernel.org/stable/c/906dec15b9b321b546fd31a3c99ffc13724c7af4" } ], "release_date": "2025-05-09T06:45:45Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-09T06:45:45Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47352", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Add validation for used length\n\nThis adds validation for used length (might come\nfrom an untrusted device) to avoid data corruption\nor loss.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47352" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3133e01514c3c498f2b01ff210ee6134b70c663c", "url": "https://git.kernel.org/stable/c/3133e01514c3c498f2b01ff210ee6134b70c663c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad993a95c508417acdeb15244109e009e50d8758", "url": "https://git.kernel.org/stable/c/ad993a95c508417acdeb15244109e009e50d8758" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba710baa1cc1b17a0483f7befe03e696efd17292", "url": "https://git.kernel.org/stable/c/ba710baa1cc1b17a0483f7befe03e696efd17292" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1b40d1959517ff2ea473d40eeab4691d6d62462", "url": "https://git.kernel.org/stable/c/c1b40d1959517ff2ea473d40eeab4691d6d62462" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c92298d228f61589dd21657af2bea95fc866b813", "url": "https://git.kernel.org/stable/c/c92298d228f61589dd21657af2bea95fc866b813" } ], "release_date": "2024-05-21T14:35:56Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-21T14:35:56Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50552", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: use quiesced elevator switch when reinitializing queues\n\nThe hctx's run_work may be racing with the elevator switch when\nreinitializing hardware queues. The queue is merely frozen in this\ncontext, but that only prevents requests from allocating and doesn't\nstop the hctx work from running. The work may get an elevator pointer\nthat's being torn down, and can result in use-after-free errors and\nkernel panics (example below). Use the quiesced elevator switch instead,\nand make the previous one static since it is now only used locally.\n\n nvme nvme0: resetting controller\n nvme nvme0: 32/0/0 default/read/poll queues\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 80000020c8861067 P4D 80000020c8861067 PUD 250f8c8067 PMD 0\n Oops: 0000 [#1] SMP PTI\n Workqueue: kblockd blk_mq_run_work_fn\n RIP: 0010:kyber_has_work+0x29/0x70\n\n...\n\n Call Trace:\n __blk_mq_do_dispatch_sched+0x83/0x2b0\n __blk_mq_sched_dispatch_requests+0x12e/0x170\n blk_mq_sched_dispatch_requests+0x30/0x60\n __blk_mq_run_hw_queue+0x2b/0x50\n process_one_work+0x1ef/0x380\n worker_thread+0x2d/0x3e0", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50552" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f90015383cd3f1128bebfbe7a97122d97808046", "url": "https://git.kernel.org/stable/c/0f90015383cd3f1128bebfbe7a97122d97808046" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63a681bcc32a43528ce0f690569f7f48e59c3963", "url": "https://git.kernel.org/stable/c/63a681bcc32a43528ce0f690569f7f48e59c3963" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8237c01f1696bc53c470493bf1fe092a107648a6", "url": "https://git.kernel.org/stable/c/8237c01f1696bc53c470493bf1fe092a107648a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9646443f28f33ec545ae303e613c3f476fad4dc1", "url": "https://git.kernel.org/stable/c/9646443f28f33ec545ae303e613c3f476fad4dc1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c478b3b2900f1834cf9eda5bfef0d5696099505d", "url": "https://git.kernel.org/stable/c/c478b3b2900f1834cf9eda5bfef0d5696099505d" } ], "release_date": "2025-10-07T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-07T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23001", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)->vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry->vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23001" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed", "url": "https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f", "url": "https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5", "url": "https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e", "url": "https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e", "url": "https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e", "url": "https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13", "url": "https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13" } ], "release_date": "2026-01-25T14:36:15Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-25T14:36:15Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53040", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate bg_bits during freefrag scan\n\n[BUG]\nA crafted filesystem can trigger an out-of-bounds bitmap walk when\nOCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.\n\nBUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nRead of size 8 at addr ffff888031bce000 by task syz.0.636/1435\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186 [inline]\n kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200\n __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n test_bit_le include/asm-generic/bitops/le.h:21 [inline]\n ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\n ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\n ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\n ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\n ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828\n ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n ...\n\n[CAUSE]\nocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the\nbitmap scan limit. The coherent path reads group descriptors through\nocfs2_read_group_descriptor(), which validates the descriptor before\nuse. The non-coherent path uses ocfs2_read_blocks_sync() instead and\nskips that validation, so an impossible bg_bits value can drive the\nbitmap walk past the end of the block.\n\n[FIX]\nCompute the bitmap capacity from the filesystem format with\nocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds\nthat limit, and clamp the scan to the computed capacity. This keeps the\nfreefrag report going while avoiding reads beyond the buffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53040" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e", "url": "https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8", "url": "https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8", "url": "https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2", "url": "https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b", "url": "https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07", "url": "https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8", "url": "https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0dcf12665d6dde37facf790803cdad44d5c328c", "url": "https://git.kernel.org/stable/c/e0dcf12665d6dde37facf790803cdad44d5c328c" } ], "release_date": "2026-06-24T16:29:46Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T16:29:46Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38445", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: Fix stack memory use after return in raid1_reshape\n\nIn the raid1_reshape function, newpool is\nallocated on the stack and assigned to conf->r1bio_pool.\nThis results in conf->r1bio_pool.wait.head pointing\nto a stack address.\nAccessing this address later can lead to a kernel panic.\n\nExample access path:\n\nraid1_reshape()\n{\n\t// newpool is on the stack\n\tmempool_t newpool, oldpool;\n\t// initialize newpool.wait.head to stack address\n\tmempool_init(&newpool, ...);\n\tconf->r1bio_pool = newpool;\n}\n\nraid1_read_request() or raid1_write_request()\n{\n\talloc_r1bio()\n\t{\n\t\tmempool_alloc()\n\t\t{\n\t\t\t// if pool->alloc fails\n\t\t\tremove_element()\n\t\t\t{\n\t\t\t\t--pool->curr_nr;\n\t\t\t}\n\t\t}\n\t}\n}\n\nmempool_free()\n{\n\tif (pool->curr_nr < pool->min_nr) {\n\t\t// pool->wait.head is a stack address\n\t\t// wake_up() will try to access this invalid address\n\t\t// which leads to a kernel panic\n\t\treturn;\n\t\twake_up(&pool->wait);\n\t}\n}\n\nFix:\nreinit conf->r1bio_pool.wait after assigning newpool.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38445" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12b00ec99624f8da8c325f2dd6e807df26df0025", "url": "https://git.kernel.org/stable/c/12b00ec99624f8da8c325f2dd6e807df26df0025" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48da050b4f54ed639b66278d0ae6f4107b2c4e2d", "url": "https://git.kernel.org/stable/c/48da050b4f54ed639b66278d0ae6f4107b2c4e2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f35e48b76655e45522df338876dfef88dafcc71", "url": "https://git.kernel.org/stable/c/5f35e48b76655e45522df338876dfef88dafcc71" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb", "url": "https://git.kernel.org/stable/c/61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/776e6186dc9ecbdb8a1b706e989166c8a99bbf64", "url": "https://git.kernel.org/stable/c/776e6186dc9ecbdb8a1b706e989166c8a99bbf64" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98", "url": "https://git.kernel.org/stable/c/d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8a6853d00fbaa810765c8ed2f452a5832273968", "url": "https://git.kernel.org/stable/c/d8a6853d00fbaa810765c8ed2f452a5832273968" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df5894014a92ff0196dbc212a7764e97366fd2b7", "url": "https://git.kernel.org/stable/c/df5894014a92ff0196dbc212a7764e97366fd2b7" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-25T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-25T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23216", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn->conn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23216" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110", "url": "https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44", "url": "https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3", "url": "https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f", "url": "https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75", "url": "https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903", "url": "https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201", "url": "https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201" } ], "release_date": "2026-02-18T15:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-18T15:18:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46116", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n Workqueue: netns cleanup_net\n Call Trace:\n __hlist_del / hlist_del_rcu\n __xfrm_state_delete\n xfrm_state_delete\n xfrm_state_flush\n xfrm_state_fini\n ops_exit_list\n cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x->km.seq)\n\t\thlist_del_rcu(&x->byseq);\n\tif (x->id.spi)\n\t\thlist_del_rcu(&x->byspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx->id.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x->id.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x->km.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n bysrc, byseq and byspi so a second deletion is a no-op rather\n than a write through LIST_POISON pprev. The byseq/byspi nodes\n are already initialised in xfrm_state_alloc().\n - Test hlist_unhashed() rather than the value predicate for\n byseq/byspi, so the unhash decision tracks list state rather than\n mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n - 9 unique signatures collected in ~9h, all within xfrm_state\n lifecycle", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46116" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3", "url": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0", "url": "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc", "url": "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8", "url": "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050", "url": "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6", "url": "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5", "url": "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182", "url": "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36018", "url": "https://access.redhat.com/errata/RHSA-2026:36018" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39179", "url": "https://access.redhat.com/errata/RHSA-2026:39179" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39180", "url": "https://access.redhat.com/errata/RHSA-2026:39180" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:39371", "url": "https://access.redhat.com/errata/RHSA-2026:39371" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41234", "url": "https://access.redhat.com/errata/RHSA-2026:41234" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41235", "url": "https://access.redhat.com/errata/RHSA-2026:41235" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:42919", "url": "https://access.redhat.com/errata/RHSA-2026:42919" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:43231", "url": "https://access.redhat.com/errata/RHSA-2026:43231" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:44385", "url": "https://access.redhat.com/errata/RHSA-2026:44385" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47632", "url": "https://access.redhat.com/errata/RHSA-2026:47632" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47633", "url": "https://access.redhat.com/errata/RHSA-2026:47633" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47739", "url": "https://access.redhat.com/errata/RHSA-2026:47739" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47869", "url": "https://access.redhat.com/errata/RHSA-2026:47869" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49033", "url": "https://access.redhat.com/errata/RHSA-2026:49033" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59142", "url": "https://access.redhat.com/errata/RHSA-2026:59142" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59143", "url": "https://access.redhat.com/errata/RHSA-2026:59143" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59145", "url": "https://access.redhat.com/errata/RHSA-2026:59145" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59146", "url": "https://access.redhat.com/errata/RHSA-2026:59146" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59147", "url": "https://access.redhat.com/errata/RHSA-2026:59147" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59148", "url": "https://access.redhat.com/errata/RHSA-2026:59148" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:59149", "url": "https://access.redhat.com/errata/RHSA-2026:59149" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46116", "url": "https://access.redhat.com/security/cve/CVE-2026-46116" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T10:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39839", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39839" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183", "url": "https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c", "url": "https://git.kernel.org/stable/c/20080709457bc1e920eb002483d7d981d9b2ac1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f", "url": "https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863", "url": "https://git.kernel.org/stable/c/5d334bce9fad58cf328d8fa14ea1fff855819863" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48", "url": "https://git.kernel.org/stable/c/a67c6397fcb7e842d3c595243049940970541c48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1", "url": "https://git.kernel.org/stable/c/bb37252c9af1cb250f34735ee98f80b46be3cef1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087", "url": "https://git.kernel.org/stable/c/d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a", "url": "https://git.kernel.org/stable/c/dce6c2aa70e94c04c523b375dfcc664d7a0a560a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" } ], "release_date": "2025-09-19T15:26:14Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-19T15:26:14Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53228", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head's remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53228" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0", "url": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43", "url": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193", "url": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4", "url": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5", "url": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c", "url": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de", "url": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b", "url": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b" } ], "release_date": "2026-06-25T08:39:27Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:27Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43020", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43020" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d", "url": "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64", "url": "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009", "url": "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257", "url": "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6", "url": "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15", "url": "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce", "url": "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c", "url": "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39684", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()\n\nsyzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel\nbuffer is allocated to hold `insn->n` samples (each of which is an\n`unsigned int`). For some instruction types, `insn->n` samples are\ncopied back to user-space, unless an error code is being returned. The\nproblem is that not all the instruction handlers that need to return\ndata to userspace fill in the whole `insn->n` samples, so that there is\nan information leak. There is a similar syzbot report for\n`do_insnlist_ioctl()`, although it does not have a reproducer for it at\nthe time of writing.\n\nOne culprit is `insn_rw_emulate_bits()` which is used as the handler for\n`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have\na specific handler for that instruction, but do have an `INSN_BITS`\nhandler. For `INSN_READ` it only fills in at most 1 sample, so if\n`insn->n` is greater than 1, the remaining `insn->n - 1` samples copied\nto userspace will be uninitialized kernel data.\n\nAnother culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It\nnever returns an error, even if it fails to fill the buffer.\n\nFix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure\nthat uninitialized parts of the allocated buffer are zeroed before\nhandling each instruction.\n\nThanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix\nreplaced the call to `kmalloc_array()` with `kcalloc()`, but it is not\nalways necessary to clear the whole buffer.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39684" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb", "url": "https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a", "url": "https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a", "url": "https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d84f6e77ebe3359394df32ecd97e0d76a25283dc", "url": "https://git.kernel.org/stable/c/d84f6e77ebe3359394df32ecd97e0d76a25283dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743", "url": "https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a", "url": "https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-05T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-05T18:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-71116", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make decode_pool() more resilient against corrupted osdmaps\n\nIf the osdmap is (maliciously) corrupted such that the encoded length\nof ceph_pg_pool envelope is less than what is expected for a particular\nencoding version, out-of-bounds reads may ensue because the only bounds\ncheck that is there is based on that length value.\n\nThis patch adds explicit bounds checks for each field that is decoded\nor skipped.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71116" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/145d140abda80e33331c5781d6603014fa75d258", "url": "https://git.kernel.org/stable/c/145d140abda80e33331c5781d6603014fa75d258" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2acb8517429ab42146c6c0ac1daed1f03d2fd125", "url": "https://git.kernel.org/stable/c/2acb8517429ab42146c6c0ac1daed1f03d2fd125" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d0d8c292531fe356c4e94dcfdf7d7212aca9957", "url": "https://git.kernel.org/stable/c/5d0d8c292531fe356c4e94dcfdf7d7212aca9957" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c738512714e8c0aa18f8a10c072d5b01c83db39", "url": "https://git.kernel.org/stable/c/8c738512714e8c0aa18f8a10c072d5b01c83db39" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c82e39ff67353a5a6cbc07b786b8690bd2c45aaa", "url": "https://git.kernel.org/stable/c/c82e39ff67353a5a6cbc07b786b8690bd2c45aaa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d061be4c8040ffb1110d537654a038b8b6ad39d2", "url": "https://git.kernel.org/stable/c/d061be4c8040ffb1110d537654a038b8b6ad39d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e927ab132b87ba3f076705fc2684d94b24201ed1", "url": "https://git.kernel.org/stable/c/e927ab132b87ba3f076705fc2684d94b24201ed1" } ], "release_date": "2026-01-14T15:06:04Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-14T15:06:04Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-46818", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check gpio_id before used as array index\n\n[WHY & HOW]\nGPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore\nshould be checked in advance.\n\nThis fixes 5 OVERRUN issues reported by Coverity.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-46818" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0184cca30cad74d88f5c875d4e26999e26325700", "url": "https://git.kernel.org/stable/c/0184cca30cad74d88f5c875d4e26999e26325700" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/08e7755f754e3d2cef7d3a7da538d33526bd6f7c", "url": "https://git.kernel.org/stable/c/08e7755f754e3d2cef7d3a7da538d33526bd6f7c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/276e3fd93e3beb5894eb1cc8480f9f417d51524d", "url": "https://git.kernel.org/stable/c/276e3fd93e3beb5894eb1cc8480f9f417d51524d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a5626eeb3b5eec7a36886f9556113dd93ec8ed6", "url": "https://git.kernel.org/stable/c/2a5626eeb3b5eec7a36886f9556113dd93ec8ed6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d4198ab612ad48f73383ad3bb5663e6f0cdf406", "url": "https://git.kernel.org/stable/c/3d4198ab612ad48f73383ad3bb5663e6f0cdf406" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40c2e8bc117cab8bca8814735f28a8b121654a84", "url": "https://git.kernel.org/stable/c/40c2e8bc117cab8bca8814735f28a8b121654a84" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8520fdc8ecc38f240a8e9e7af89cca6739c3e790", "url": "https://git.kernel.org/stable/c/8520fdc8ecc38f240a8e9e7af89cca6739c3e790" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-09-27T12:35:59Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-09-27T12:35:59Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50036", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n dst_release_immediate(child), this might also cause UAF\n if the child does not have DST_NOCOUNT set.\n IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n which might happen in future kernels.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50036" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc", "url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a", "url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f", "url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d", "url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96", "url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd", "url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-10-21T19:39:37Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-10-21T19:39:37Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47391", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n CPU 1 CPU 2\n\nrdma_resolve_addr():\n RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY\n rdma_resolve_ip(addr_handler) #1\n\n\t\t\t process_one_req(): for #1\n addr_handler():\n RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND\n mutex_unlock(&id_priv->handler_mutex);\n [.. handler still running ..]\n\nrdma_resolve_addr():\n RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY\n rdma_resolve_ip(addr_handler)\n !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n _destroy_id():\n cma_cancel_operation():\n rdma_addr_cancel()\n\n // process_one_req() self removes it\n\t\t spin_lock_bh(&lock);\n cancel_delayed_work(&req->work);\n\t if (!list_empty(&req->list)) == true\n\n ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n addr_handler():\n\t mutex_lock(&id_priv->handler_mutex);\n !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn't cost anything in the normal flow\nthat never uses this strange error path.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47391" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589", "url": "https://git.kernel.org/stable/c/03d884671572af8bcfbc9e63944c1021efce7589" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808", "url": "https://git.kernel.org/stable/c/305d568b72f17f674155a2a8275f865f207b3808" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a", "url": "https://git.kernel.org/stable/c/9a085fa9b7d644a234465091e038c1911e1a4f2a" } ], "release_date": "2024-05-21T15:03:49Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-21T15:03:49Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46259", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent\nwithout proper RCU protection, which leads to:\n\n cpu 0 cpu 1\n ----- -----\n do_task_stat\n var = task->real_parent\n release_task\n call_rcu(delayed_put_task_struct)\n task_tgid_nr_ns(var)\n rcu_read_lock <--- Too late to protect task->real_parent!\n task_pid_ptr <--- UAF!\n rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task->real_parent.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46259" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e", "url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306", "url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee", "url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6", "url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867", "url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982", "url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6", "url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04", "url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04" } ], "release_date": "2026-06-03T15:49:56Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-03T15:49:56Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43027", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately. Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp->helper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n Read of size 1 at addr ffff888003b14d20 by task poc/103\n Call Trace:\n string+0x38f/0x430\n vsnprintf+0x3cc/0x1170\n seq_printf+0x17a/0x240\n exp_seq_show+0x2e5/0x560\n seq_read_iter+0x419/0x1280\n proc_reg_read+0x1ac/0x270\n vfs_read+0x179/0x930\n ksys_read+0xef/0x1c0\n Freed by task 103:\n The buggy address is located 32 bytes inside of\n freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43027" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a", "url": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be", "url": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6", "url": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1", "url": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3", "url": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965", "url": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65", "url": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af", "url": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53138", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Bound VBIOS record-chain walk loops\n\n[Why & How]\nAll record-chain walk loops in bios_parser.c and bios_parser2.c use\nfor(;;) and only terminate on a 0xFF record_type sentinel or zero\nrecord_size. A malformed VBIOS image missing the terminator record\ncauses unbounded iteration at probe time, potentially hundreds of\nthousands of iterations with record_size=1. In the final iterations\nnear the BIOS image boundary, struct casts beyond the 2-byte header\nvalidated by GET_IMAGE can also read out of bounds.\n\nCap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)\niterations. The atombios.h defines up to 22 distinct record types\nand atomfirmware.h has 13. Assuming an average of less than 10\nrecords per type (which is reasonable since most are connector-\nbased) 256 is a generous upper bound.\n\n(cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53138" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04e271a952b8863bbafc99bd51aca4c32bff0e0d", "url": "https://git.kernel.org/stable/c/04e271a952b8863bbafc99bd51aca4c32bff0e0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1", "url": "https://git.kernel.org/stable/c/0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2645e3caf7e013189da9c6ff621d006cca5a538b", "url": "https://git.kernel.org/stable/c/2645e3caf7e013189da9c6ff621d006cca5a538b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/499c6b43a79dd684bddbd18fe8b2235aa2764db4", "url": "https://git.kernel.org/stable/c/499c6b43a79dd684bddbd18fe8b2235aa2764db4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6173cfea2f916e01c4f98e29cd654384a05e32a3", "url": "https://git.kernel.org/stable/c/6173cfea2f916e01c4f98e29cd654384a05e32a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56", "url": "https://git.kernel.org/stable/c/6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e94f5323c41f32a74160378c3b19850d1f203ad5", "url": "https://git.kernel.org/stable/c/e94f5323c41f32a74160378c3b19850d1f203ad5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff287df16a1a58aca78b08d1f3ee09fc44da0351", "url": "https://git.kernel.org/stable/c/ff287df16a1a58aca78b08d1f3ee09fc44da0351" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T09:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46006", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n\nnouveau_gem_pushbuf_reloc_apply() validates each relocation with\n\n if (r->reloc_bo_offset + 4 > nvbo->bo.base.size)\n\nbut reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer\nliteral 4 promotes to unsigned int, so the addition is performed in 32\nbits and wraps before the comparison against the size_t bo size.\n\nCast to u64 so the addition happens in 64-bit arithmetic.\n\n[ Add Fixes: tag. - Danilo ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46006" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5", "url": "https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31", "url": "https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909", "url": "https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7cc", "url": "https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92a", "url": "https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637", "url": "https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9", "url": "https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6", "url": "https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6" } ], "release_date": "2026-05-27T12:56:05Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-27T12:56:05Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38157", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Abort software beacon handling if disabled\n\nA malicious USB device can send a WMI_SWBA_EVENTID event from an\nath9k_htc-managed device before beaconing has been enabled. This causes\na device-by-zero error in the driver, leading to either a crash or an\nout of bounds read.\n\nPrevent this by aborting the handling in ath9k_htc_swba() if beacons are\nnot enabled.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0281c19074976ec48f0078d50530b406ddae75bc", "url": "https://git.kernel.org/stable/c/0281c19074976ec48f0078d50530b406ddae75bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40471b23147c86ea3ed97faee79937c618250bd0", "url": "https://git.kernel.org/stable/c/40471b23147c86ea3ed97faee79937c618250bd0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5482ef9875eaa43f0435e14570e1193823de857e", "url": "https://git.kernel.org/stable/c/5482ef9875eaa43f0435e14570e1193823de857e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a85c21f812e02cb00ca07007d88acdd42d08c46", "url": "https://git.kernel.org/stable/c/5a85c21f812e02cb00ca07007d88acdd42d08c46" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ee3fb6258da8c890a51b514f60d7570dc703605", "url": "https://git.kernel.org/stable/c/7ee3fb6258da8c890a51b514f60d7570dc703605" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac4e317a95a1092b5da5b9918b7118759342641c", "url": "https://git.kernel.org/stable/c/ac4e317a95a1092b5da5b9918b7118759342641c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5ce9df1d68094d37360dbd9b09289d42fa21e54", "url": "https://git.kernel.org/stable/c/e5ce9df1d68094d37360dbd9b09289d42fa21e54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee5ee646385f5846dcbc881389f3c44a197c402a", "url": "https://git.kernel.org/stable/c/ee5ee646385f5846dcbc881389f3c44a197c402a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-03T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-03T09:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-22121", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22121" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a", "url": "https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8", "url": "https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56", "url": "https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619", "url": "https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4", "url": "https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566", "url": "https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f", "url": "https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2025-04-16T14:13:05Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-04-16T14:13:05Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38618", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Do not allow binding to VMADDR_PORT_ANY\n\nIt is possible for a vsock to autobind to VMADDR_PORT_ANY. This can\ncause a use-after-free when a connection is made to the bound socket.\nThe socket returned by accept() also has port VMADDR_PORT_ANY but is not\non the list of unbound sockets. Binding it will result in an extra\nrefcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep\nthe binding until socket destruction).\n\nModify the check in __vsock_bind_connectible() to also prevent binding\nto VMADDR_PORT_ANY.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38618" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32950b1907919be86a7a2697d6f93d57068b3865", "url": "https://git.kernel.org/stable/c/32950b1907919be86a7a2697d6f93d57068b3865" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44bd006d5c93f6a8f28b106cbae2428c5d0275b7", "url": "https://git.kernel.org/stable/c/44bd006d5c93f6a8f28b106cbae2428c5d0275b7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f01093646b49f6330bb2d36761983fd829472b1", "url": "https://git.kernel.org/stable/c/8f01093646b49f6330bb2d36761983fd829472b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aba0c94f61ec05315fa7815d21aefa4c87f6a9f4", "url": "https://git.kernel.org/stable/c/aba0c94f61ec05315fa7815d21aefa4c87f6a9f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c04a2c1ca25b9b23104124d3b2d349d934e302de", "url": "https://git.kernel.org/stable/c/c04a2c1ca25b9b23104124d3b2d349d934e302de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf86704798c1b9c46fa59dfc2d662f57d1394d79", "url": "https://git.kernel.org/stable/c/cf86704798c1b9c46fa59dfc2d662f57d1394d79" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d1a5b1964cef42727668ac0d8532dae4f8c19386", "url": "https://git.kernel.org/stable/c/d1a5b1964cef42727668ac0d8532dae4f8c19386" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d73960f0cf03ef1dc9e96ec7a20e538accc26d87", "url": "https://git.kernel.org/stable/c/d73960f0cf03ef1dc9e96ec7a20e538accc26d87" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f138be5d7f301fddad4e65ec66dfc3ceebf79be3", "url": "https://git.kernel.org/stable/c/f138be5d7f301fddad4e65ec66dfc3ceebf79be3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-08-22T13:01:24Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-08-22T13:01:24Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38708", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: add missing kref_get in handle_write_conflicts\n\nWith `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes\nand handle write conflicts, so that even if you write to the same sector\nsimultaneously on both nodes, they end up with the identical data once\nthe writes are completed.\n\nIn handling \"superseeded\" writes, we forgot a kref_get,\nresulting in a premature drbd_destroy_device and use after free,\nand further to kernel crashes with symptoms.\n\nRelevance: No one should use DRBD as a random data generator, and apparently\nall users of \"two-primaries\" handle concurrent writes correctly on layer up.\nThat is cluster file systems use some distributed lock manager,\nand live migration in virtualization environments stops writes on one node\nbefore starting writes on the other node.\n\nWhich means that other than for \"test cases\",\nthis code path is never taken in real life.\n\nFYI, in DRBD 9, things are handled differently nowadays. We still detect\n\"write conflicts\", but no longer try to be smart about them.\nWe decided to disconnect hard instead: upper layers must not submit concurrent\nwrites. If they do, that's their fault.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38708" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8", "url": "https://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5", "url": "https://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20", "url": "https://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89", "url": "https://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575", "url": "https://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8", "url": "https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1", "url": "https://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf", "url": "https://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4", "url": "https://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2025-09-04T15:32:59Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-04T15:32:59Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39824", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix UAF via HID_CLAIMED_INPUT validation\n\nAfter hid_hw_start() is called hidinput_connect() will eventually be\ncalled to set up the device with the input layer since the\nHID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()\nall input and output reports are processed and corresponding hid_inputs\nare allocated and configured via hidinput_configure_usages(). This\nprocess involves slot tagging report fields and configuring usages\nby setting relevant bits in the capability bitmaps. However it is possible\nthat the capability bitmaps are not set at all leading to the subsequent\nhidinput_has_been_populated() check to fail leading to the freeing of the\nhid_input and the underlying input device.\n\nThis becomes problematic because a malicious HID device like a\nASUS ROG N-Key keyboard can trigger the above scenario via a\nspecially crafted descriptor which then leads to a user-after-free\nwhen the name of the freed input device is written to later on after\nhid_hw_start(). Below, report 93 intentionally utilises the\nHID_UP_UNDEFINED Usage Page which is skipped during usage\nconfiguration, leading to the frees.\n\n0x05, 0x0D, // Usage Page (Digitizer)\n0x09, 0x05, // Usage (Touch Pad)\n0xA1, 0x01, // Collection (Application)\n0x85, 0x0D, // Report ID (13)\n0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)\n0x09, 0xC5, // Usage (0xC5)\n0x15, 0x00, // Logical Minimum (0)\n0x26, 0xFF, 0x00, // Logical Maximum (255)\n0x75, 0x08, // Report Size (8)\n0x95, 0x04, // Report Count (4)\n0xB1, 0x02, // Feature (Data,Var,Abs)\n0x85, 0x5D, // Report ID (93)\n0x06, 0x00, 0x00, // Usage Page (Undefined)\n0x09, 0x01, // Usage (0x01)\n0x15, 0x00, // Logical Minimum (0)\n0x26, 0xFF, 0x00, // Logical Maximum (255)\n0x75, 0x08, // Report Size (8)\n0x95, 0x1B, // Report Count (27)\n0x81, 0x02, // Input (Data,Var,Abs)\n0xC0, // End Collection\n\nBelow is the KASAN splat after triggering the UAF:\n\n[ 21.672709] ==================================================================\n[ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80\n[ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54\n[ 21.673700]\n[ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)\n[ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[ 21.673700] Call Trace:\n[ 21.673700] \n[ 21.673700] dump_stack_lvl+0x5f/0x80\n[ 21.673700] print_report+0xd1/0x660\n[ 21.673700] kasan_report+0xe5/0x120\n[ 21.673700] __asan_report_store8_noabort+0x1b/0x30\n[ 21.673700] asus_probe+0xeeb/0xf80\n[ 21.673700] hid_device_probe+0x2ee/0x700\n[ 21.673700] really_probe+0x1c6/0x6b0\n[ 21.673700] __driver_probe_device+0x24f/0x310\n[ 21.673700] driver_probe_device+0x4e/0x220\n[...]\n[ 21.673700]\n[ 21.673700] Allocated by task 54:\n[ 21.673700] kasan_save_stack+0x3d/0x60\n[ 21.673700] kasan_save_track+0x18/0x40\n[ 21.673700] kasan_save_alloc_info+0x3b/0x50\n[ 21.673700] __kasan_kmalloc+0x9c/0xa0\n[ 21.673700] __kmalloc_cache_noprof+0x139/0x340\n[ 21.673700] input_allocate_device+0x44/0x370\n[ 21.673700] hidinput_connect+0xcb6/0x2630\n[ 21.673700] hid_connect+0xf74/0x1d60\n[ 21.673700] hid_hw_start+0x8c/0x110\n[ 21.673700] asus_probe+0x5a3/0xf80\n[ 21.673700] hid_device_probe+0x2ee/0x700\n[ 21.673700] really_probe+0x1c6/0x6b0\n[ 21.673700] __driver_probe_device+0x24f/0x310\n[ 21.673700] driver_probe_device+0x4e/0x220\n[...]\n[ 21.673700]\n[ 21.673700] Freed by task 54:\n[ 21.673700] kasan_save_stack+0x3d/0x60\n[ 21.673700] kasan_save_track+0x18/0x40\n[ 21.673700] kasan_save_free_info+0x3f/0x60\n[ 21.673700] __kasan_slab_free+0x3c/0x50\n[ 21.673700] kfre\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39824" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d", "url": "https://git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5", "url": "https://git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275", "url": "https://git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7", "url": "https://git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c", "url": "https://git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c", "url": "https://git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4", "url": "https://git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2", "url": "https://git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-16T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-16T13:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43052", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check tdls flag in ieee80211_tdls_oper\n\nWhen NL80211_TDLS_ENABLE_LINK is called, the code only checks if the\nstation exists but not whether it is actually a TDLS station. This\nallows the operation to proceed for non-TDLS stations, causing\nunintended side effects like modifying channel context and HT\nprotection before failing.\n\nAdd a check for sta->sta.tdls early in the ENABLE_LINK case, before\nany side effects occur, to ensure the operation is only allowed for\nactual TDLS peers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43052" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44839ea7e96b3659a1606f3d5267063135479b7c", "url": "https://git.kernel.org/stable/c/44839ea7e96b3659a1606f3d5267063135479b7c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6813a8b1b240756dad4375f3e020ce10e4e3871b", "url": "https://git.kernel.org/stable/c/6813a8b1b240756dad4375f3e020ce10e4e3871b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d73872d949c488a1d7c308031d6a9d89b5e0a8b", "url": "https://git.kernel.org/stable/c/7d73872d949c488a1d7c308031d6a9d89b5e0a8b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8148c2fda4ebb17104a573649c9b699208ad10ee", "url": "https://git.kernel.org/stable/c/8148c2fda4ebb17104a573649c9b699208ad10ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba5b43db126a5e7378553869e3f7954d9187349f", "url": "https://git.kernel.org/stable/c/ba5b43db126a5e7378553869e3f7954d9187349f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be81f17151fcb8546a95f35ca8f4231b065985de", "url": "https://git.kernel.org/stable/c/be81f17151fcb8546a95f35ca8f4231b065985de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e602246235fc2ef06c39b2e9cf147d84d0896b73", "url": "https://git.kernel.org/stable/c/e602246235fc2ef06c39b2e9cf147d84d0896b73" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e77b2937aaa20264e4bd699d3244bdb50e7e3343", "url": "https://git.kernel.org/stable/c/e77b2937aaa20264e4bd699d3244bdb50e7e3343" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46333", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46333" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730", "url": "https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205", "url": "https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d", "url": "https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "url": "https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181", "url": "https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d", "url": "https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7", "url": "https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6", "url": "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/15/9", "url": "http://www.openwall.com/lists/oss-security/2026/05/15/9" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/20/14", "url": "http://www.openwall.com/lists/oss-security/2026/05/20/14" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/20/16", "url": "http://www.openwall.com/lists/oss-security/2026/05/20/16" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html", "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html", "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19521", "url": "https://access.redhat.com/errata/RHSA-2026:19521" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19540", "url": "https://access.redhat.com/errata/RHSA-2026:19540" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19568", "url": "https://access.redhat.com/errata/RHSA-2026:19568" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19569", "url": "https://access.redhat.com/errata/RHSA-2026:19569" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19664", "url": "https://access.redhat.com/errata/RHSA-2026:19664" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19666", "url": "https://access.redhat.com/errata/RHSA-2026:19666" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19705", "url": "https://access.redhat.com/errata/RHSA-2026:19705" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19711", "url": "https://access.redhat.com/errata/RHSA-2026:19711" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19875", "url": "https://access.redhat.com/errata/RHSA-2026:19875" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20051", "url": "https://access.redhat.com/errata/RHSA-2026:20051" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20054", "url": "https://access.redhat.com/errata/RHSA-2026:20054" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20129", "url": "https://access.redhat.com/errata/RHSA-2026:20129" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20130", "url": "https://access.redhat.com/errata/RHSA-2026:20130" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20299", "url": "https://access.redhat.com/errata/RHSA-2026:20299" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20593", "url": "https://access.redhat.com/errata/RHSA-2026:20593" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:21701", "url": "https://access.redhat.com/errata/RHSA-2026:21701" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:21702", "url": "https://access.redhat.com/errata/RHSA-2026:21702" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:23468", "url": "https://access.redhat.com/errata/RHSA-2026:23468" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:23469", "url": "https://access.redhat.com/errata/RHSA-2026:23469" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:23470", "url": "https://access.redhat.com/errata/RHSA-2026:23470" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:23471", "url": "https://access.redhat.com/errata/RHSA-2026:23471" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24814", "url": "https://access.redhat.com/errata/RHSA-2026:24814" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33486", "url": "https://access.redhat.com/errata/RHSA-2026:33486" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46333", "url": "https://access.redhat.com/security/cve/CVE-2026-46333" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477802" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/", "url": "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json" } ], "release_date": "2026-05-15T12:58:44Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-15T12:58:44Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53224", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53224" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6", "url": "https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b", "url": "https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557", "url": "https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557" } ], "release_date": "2026-06-25T08:39:25Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:25Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23372", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket. rawsock_tx_work runs on the system\nworkqueue and calls nfc_data_exchange which dereferences the NCI\ndevice. Without synchronization, tx_work can race with socket and\ndevice teardown when a process is killed (e.g. by SIGKILL), leading\nto use-after-free or leaked references.\n\nSet SEND_SHUTDOWN first so that if tx_work is already running it will\nsee the flag and skip transmitting, then use cancel_work_sync to wait\nfor any in-progress execution to finish, and finally purge any\nremaining queued skbs.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23372" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049", "url": "https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526", "url": "https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24", "url": "https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c", "url": "https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16", "url": "https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa", "url": "https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45", "url": "https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06", "url": "https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06" } ], "release_date": "2026-03-25T10:27:53Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-25T10:27:53Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43386", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie\n\nThe current code checks 'i + 5 < in_len' at the end of the if statement.\nHowever, it accesses 'in_ie[i + 5]' before that check, which can lead\nto an out-of-bounds read. Move the length check to the beginning of the\nconditional to ensure the index is within bounds before accessing the\narray.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43386" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020", "url": "https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6", "url": "https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b", "url": "https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259", "url": "https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8", "url": "https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b", "url": "https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c", "url": "https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e14a1148f02e8cf1ca380d57e4b95ca36c97f45d", "url": "https://git.kernel.org/stable/c/e14a1148f02e8cf1ca380d57e4b95ca36c97f45d" } ], "release_date": "2026-05-08T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-08T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53036", "cwe": { "id": "CWE-193", "name": "Off-by-one Error" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix off-by-one in check_imm signed range check\n\ncheck_imm(bits, imm) is used in the arm64 BPF JIT to verify that\na branch displacement (in arm64 instruction units) fits into the\nsigned N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding\nbefore it is handed to the encoder. The macro currently tests for\n(imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits\nvalues in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A\nsigned N-bit field only holds [-2^(N-1), 2^(N-1)), so the check\nadmits one extra bit of range on each side.\n\nIn particular, for check_imm19(), values in [2^18, 2^19) slip past\nthe check but do not fit into the 19-bit signed imm19 field of\nB.cond. aarch64_insn_encode_immediate() then masks the raw value\ninto the 19-bit field, setting bit 18 (the sign bit) and flipping\na forward branch into a backward one. Same class of issue exists\nfor check_imm26() and the B/BL encoding. Shift by (bits - 1)\ninstead of bits so the actual signed N-bit range is enforced.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53036" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a113b5497297871699cd498b1b83542e0db7f15", "url": "https://git.kernel.org/stable/c/1a113b5497297871699cd498b1b83542e0db7f15" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1dd8be4ec722ce54e4cace59f3a4ba658111b3ec", "url": "https://git.kernel.org/stable/c/1dd8be4ec722ce54e4cace59f3a4ba658111b3ec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6927f0d6794aa73318bbfa929f1ff6065b0620df", "url": "https://git.kernel.org/stable/c/6927f0d6794aa73318bbfa929f1ff6065b0620df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7fd3b41260c6120e7b60164afea5d961af6224f9", "url": "https://git.kernel.org/stable/c/7fd3b41260c6120e7b60164afea5d961af6224f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a5dfeb3b61065039488342d43ae06d4729d955d4", "url": "https://git.kernel.org/stable/c/a5dfeb3b61065039488342d43ae06d4729d955d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb74defa1cca1a73177c0c761e641332e4f979a3", "url": "https://git.kernel.org/stable/c/fb74defa1cca1a73177c0c761e641332e4f979a3" } ], "release_date": "2026-06-24T16:29:43Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T16:29:43Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38102", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify\n\nDuring our test, it is found that a warning can be trigger in try_grab_folio\nas follow:\n\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130\n Modules linked in:\n CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef)\n RIP: 0010:try_grab_folio+0x106/0x130\n Call Trace:\n \n follow_huge_pmd+0x240/0x8e0\n follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0\n follow_pud_mask.constprop.0.isra.0+0x14a/0x170\n follow_page_mask+0x1c2/0x1f0\n __get_user_pages+0x176/0x950\n __gup_longterm_locked+0x15b/0x1060\n ? gup_fast+0x120/0x1f0\n gup_fast_fallback+0x17e/0x230\n get_user_pages_fast+0x5f/0x80\n vmci_host_unlocked_ioctl+0x21c/0xf80\n RIP: 0033:0x54d2cd\n ---[ end trace 0000000000000000 ]---\n\nDigging into the source, context->notify_page may init by get_user_pages_fast\nand can be seen in vmci_ctx_unset_notify which will try to put_page. However\nget_user_pages_fast is not finished here and lead to following\ntry_grab_folio warning. The race condition is shown as follow:\n\ncpu0\t\t\tcpu1\nvmci_host_do_set_notify\nvmci_host_setup_notify\nget_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page);\nlockless_pages_from_mm\ngup_pgd_range\ngup_huge_pmd // update &context->notify_page\n\t\t\tvmci_host_do_set_notify\n\t\t\tvmci_ctx_unset_notify\n\t\t\tnotify_page = context->notify_page;\n\t\t\tif (notify_page)\n\t\t\tput_page(notify_page);\t// page is freed\n__gup_longterm_locked\n__get_user_pages\nfollow_trans_huge_pmd\ntry_grab_folio // warn here\n\nTo slove this, use local variable page to make notify_page can be seen\nafter finish get_user_pages_fast.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38102" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00ddc7dad55b7bbb78df80d6e174d0c4764dea0c", "url": "https://git.kernel.org/stable/c/00ddc7dad55b7bbb78df80d6e174d0c4764dea0c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1bd6406fb5f36c2bb1e96e27d4c3e9f4d09edde4", "url": "https://git.kernel.org/stable/c/1bd6406fb5f36c2bb1e96e27d4c3e9f4d09edde4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/468aec888f838ce5174b96e0cb4396790d6f60ca", "url": "https://git.kernel.org/stable/c/468aec888f838ce5174b96e0cb4396790d6f60ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58a90db70aa6616411e5f69d1982d9b1dd97d774", "url": "https://git.kernel.org/stable/c/58a90db70aa6616411e5f69d1982d9b1dd97d774" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e3af836805ed1d7a699f76ec798626198917aa4", "url": "https://git.kernel.org/stable/c/6e3af836805ed1d7a699f76ec798626198917aa4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74095bbbb19ca74a0368d857603a2438c88ca86c", "url": "https://git.kernel.org/stable/c/74095bbbb19ca74a0368d857603a2438c88ca86c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75b5313c80c39a26d27cbb602f968a05576c36f9", "url": "https://git.kernel.org/stable/c/75b5313c80c39a26d27cbb602f968a05576c36f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4209e4b778e4e57d0636e1c9fc07a924dbc6043", "url": "https://git.kernel.org/stable/c/b4209e4b778e4e57d0636e1c9fc07a924dbc6043" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-03T08:35:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-03T08:35:12Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46069", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter->hw_status, adapter->if_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46069" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf", "url": "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103", "url": "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812", "url": "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8", "url": "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618", "url": "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d", "url": "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb", "url": "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264", "url": "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-27T14:17:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31748", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards. Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31748" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172", "url": "https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319", "url": "https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8", "url": "https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb", "url": "https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a", "url": "https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b", "url": "https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0", "url": "https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8", "url": "https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31500", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31500" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d", "url": "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010", "url": "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "url": "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "url": "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "url": "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e", "url": "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e" } ], "release_date": "2026-04-22T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-22T14:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37923", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix oob write in trace_seq_to_buffer()\n\nsyzbot reported this bug:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\nBUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\nWrite of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260\n\nCPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106\n trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\n tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\n ....\n==================================================================\n\nIt has been reported that trace_seq_to_buffer() tries to copy more data\nthan PAGE_SIZE to buf. Therefore, to prevent this, we should use the\nsmaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37923" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897", "url": "https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f", "url": "https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d", "url": "https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157", "url": "https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9", "url": "https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4", "url": "https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606", "url": "https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb", "url": "https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-05-20T15:21:51Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-20T15:21:51Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50073", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: Fix use-after-free in gsm_cleanup_mux\n\nBUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0\ndrivers/tty/n_gsm.c:3160 [n_gsm]\nRead of size 8 at addr ffff88815fe99c00 by task poc/3379\nCPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56\nHardware name: VMware, Inc. VMware Virtual Platform/440BX\nDesktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n \n gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]\n __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389\n update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500\n __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846\n __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107\n __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]\n ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195\n ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79\n __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338\n __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\nAllocated by task 65:\n gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]\n gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]\n gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]\n gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]\n tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391\n tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39\n flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445\n process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229\n worker_thread+0x3dc/0x950 kernel/workqueue.c:3391\n kthread+0x2a3/0x370 kernel/kthread.c:389\n ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257\n\nFreed by task 3367:\n kfree+0x126/0x420 mm/slub.c:4580\n gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\n[Analysis]\ngsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux\ncan be freed by multi threads through ioctl,which leads\nto the occurrence of uaf. Protect it by gsm tx lock.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50073" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0eec592c6a7460ba795d7de29f3dc95cb5422e62", "url": "https://git.kernel.org/stable/c/0eec592c6a7460ba795d7de29f3dc95cb5422e62" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9462f4ca56e7d2430fdb6dcc8498244acbfc4489", "url": "https://git.kernel.org/stable/c/9462f4ca56e7d2430fdb6dcc8498244acbfc4489" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf171b5e86e41de4c1cf32fb7aefa275c3d7de49", "url": "https://git.kernel.org/stable/c/bf171b5e86e41de4c1cf32fb7aefa275c3d7de49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c29f192e0d44cc1cbaf698fa1ff198f63556691a", "url": "https://git.kernel.org/stable/c/c29f192e0d44cc1cbaf698fa1ff198f63556691a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-10-29T00:50:15Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-10-29T00:50:15Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47191", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724] program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995] dump_stack+0x108/0x15f\n[ 3813.847524] print_address_description+0xa5/0x372\n[ 3813.848243] kasan_report.cold+0x236/0x2a8\n[ 3813.849439] check_memory_region+0x240/0x270\n[ 3813.850094] memcpy+0x30/0x80\n[ 3813.850553] sg_copy_buffer+0x157/0x1e0\n[ 3813.853032] sg_copy_from_buffer+0x13/0x20\n[ 3813.853660] fill_from_dev_buffer+0x135/0x370\n[ 3813.854329] resp_readcap16+0x1ac/0x280\n[ 3813.856917] schedule_resp+0x41f/0x1630\n[ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699] scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329] scsi_request_fn+0xd8e/0x1710\n[ 3813.863946] __blk_run_queue+0x10b/0x230\n[ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220] sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637] sg_write+0x6c8/0xef0\n[ 3813.878853] __vfs_write+0xe4/0x800\n[ 3813.883487] vfs_write+0x17b/0x530\n[ 3813.884008] ksys_write+0x103/0x270\n[ 3813.886268] __x64_sys_write+0x77/0xc0\n[ 3813.886841] do_syscall_64+0x106/0x360\n[ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\\x00', 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\\x00')\nopen_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47191" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a", "url": "https://git.kernel.org/stable/c/3e20cb072679bdb47747ccc8bee3233a4cf0765a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c", "url": "https://git.kernel.org/stable/c/4e3ace0051e7e504b55d239daab8789dd89b863c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999", "url": "https://git.kernel.org/stable/c/5b8bed6464ad6653586e30df046185fd816ad999" } ], "release_date": "2024-04-10T18:56:29Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-04-10T18:56:29Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53075", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file->f_cred->user_ns,\nwhile unattached administrative ioctls operate on current->nsproxy->net_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53075" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c", "url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067", "url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e", "url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8", "url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d", "url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e", "url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54", "url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532", "url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532" } ], "release_date": "2026-06-24T16:30:16Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T16:30:16Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38494", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: do not bypass hid_hw_raw_request\n\nhid_hw_raw_request() is actually useful to ensure the provided buffer\nand length are valid. Directly calling in the low level transport driver\nfunction bypassed those checks and allowed invalid paramto be used.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38494" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81", "url": "https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0", "url": "https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed", "url": "https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f", "url": "https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b", "url": "https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5", "url": "https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624", "url": "https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910", "url": "https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-28T11:22:03Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-28T11:22:03Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-46984", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nkyber: fix out of bounds access when preempted\n\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\npasses the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx\nfor the current CPU again and uses that to get the corresponding Kyber\ncontext in the passed hctx. However, the thread may be preempted between\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\nmay no longer correspond to the passed hctx. This \"works\" accidentally\nmost of the time, but it can cause us to read garbage if the second ctx\ncame from an hctx with more ctx's than the first one (i.e., if\nctx->index_hw[hctx->type] > hctx->nr_ctx).\n\nThis manifested as this UBSAN array index out of bounds error reported\nby Jakub:\n\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\nindex 13106 is out of range for type 'long unsigned int [128]'\nCall Trace:\n dump_stack+0xa4/0xe5\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\n queued_spin_lock_slowpath+0x476/0x480\n do_raw_spin_lock+0x1c2/0x1d0\n kyber_bio_merge+0x112/0x180\n blk_mq_submit_bio+0x1f5/0x1100\n submit_bio_noacct+0x7b0/0x870\n submit_bio+0xc2/0x3a0\n btrfs_map_bio+0x4f0/0x9d0\n btrfs_submit_data_bio+0x24e/0x310\n submit_one_bio+0x7f/0xb0\n submit_extent_page+0xc4/0x440\n __extent_writepage_io+0x2b8/0x5e0\n __extent_writepage+0x28d/0x6e0\n extent_write_cache_pages+0x4d7/0x7a0\n extent_writepages+0xa2/0x110\n do_writepages+0x8f/0x180\n __writeback_single_inode+0x99/0x7f0\n writeback_sb_inodes+0x34e/0x790\n __writeback_inodes_wb+0x9e/0x120\n wb_writeback+0x4d2/0x660\n wb_workfn+0x64d/0xa10\n process_one_work+0x53a/0xa80\n worker_thread+0x69/0x5b0\n kthread+0x20b/0x240\n ret_from_fork+0x1f/0x30\n\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\n->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\nmap the queues itself to avoid the mismatch.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-46984" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5", "url": "https://git.kernel.org/stable/c/0b6b4b90b74c27bea968c214d820ba4254b903a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df", "url": "https://git.kernel.org/stable/c/2ef3c76540c49167a0bc3d5f80d00fd1fc4586df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f", "url": "https://git.kernel.org/stable/c/54dbe2d2c1fcabf650c7a8b747601da355cd7f9f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6", "url": "https://git.kernel.org/stable/c/a287cd84e047045f5a4d4da793414e848de627c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d", "url": "https://git.kernel.org/stable/c/efed9a3337e341bd0989161b97453b52567bc59d" } ], "release_date": "2024-02-28T08:13:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-02-28T08:13:12Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39863", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(&bt_local->work) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0 | CPU1\nbrcmf_btcoex_detach | brcmf_btcoex_timerfunc\n | bt_local->timer_on = false;\n if (cfg->btcoex->timer_on) |\n ... |\n cancel_work_sync(); |\n ... |\n kfree(cfg->btcoex); // FREE |\n | schedule_work(&bt_local->work); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() — such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0 | CPU1\nbrcmf_btcoex_detach | brcmf_btcoex_timerfunc\n | bt_local->timer_on = false;\n if (cfg->btcoex->timer_on) |\n ... |\n cancel_work_sync(); |\n ... | schedule_work(); // Reschedule\n |\n kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker\n /* | btci = container_of(....); // USE\n The kfree() above could | ...\n also occur at any point | btci-> // USE\n during the worker's execution|\n */ |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39863" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625", "url": "https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7", "url": "https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc", "url": "https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6", "url": "https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852", "url": "https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63", "url": "https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63" } ], "release_date": "2025-09-19T15:26:33Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-19T15:26:33Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38403", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: Clear the vmci transport packet properly when initializing it\n\nIn vmci_transport_packet_init memset the vmci_transport_packet before\npopulating the fields to avoid any uninitialised data being left in the\nstructure.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38403" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a01021317375b8d1895152f544421ce49299eb1", "url": "https://git.kernel.org/stable/c/0a01021317375b8d1895152f544421ce49299eb1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19c2cc01ff9a8031398a802676ffb0f4692dd95d", "url": "https://git.kernel.org/stable/c/19c2cc01ff9a8031398a802676ffb0f4692dd95d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c1bcb0e78230f533b4103e8cf271d17c3f469f0", "url": "https://git.kernel.org/stable/c/1c1bcb0e78230f533b4103e8cf271d17c3f469f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/223e2288f4b8c262a864e2c03964ffac91744cd5", "url": "https://git.kernel.org/stable/c/223e2288f4b8c262a864e2c03964ffac91744cd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d44723a091bc853272e1a51a488a3d22b80be5e", "url": "https://git.kernel.org/stable/c/2d44723a091bc853272e1a51a488a3d22b80be5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75705b44e0b9aaa74f4c163d93d388bcba9e386a", "url": "https://git.kernel.org/stable/c/75705b44e0b9aaa74f4c163d93d388bcba9e386a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94d0c326cb3ee6b0f8bd00e209550b93fcc5c839", "url": "https://git.kernel.org/stable/c/94d0c326cb3ee6b0f8bd00e209550b93fcc5c839" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e9a673153d578fd439919a24e99851b2f87ecbce", "url": "https://git.kernel.org/stable/c/e9a673153d578fd439919a24e99851b2f87ecbce" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-25T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-25T14:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64584", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi->work) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of(). This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi->work.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi->free_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped. In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream. A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi->work again after\nf_midi_disable() has returned. A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi->work in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns. Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(&midi->work) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure. opts->lock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi->transmit_lock rather than opts->lock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64584" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9", "url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b", "url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a", "url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1", "url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d", "url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e", "url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add", "url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69", "url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69" } ], "release_date": "2026-08-06T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-08-06T08:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23378", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] ==================================================================\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23378" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861", "url": "https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee", "url": "https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947", "url": "https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b", "url": "https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a", "url": "https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23", "url": "https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-03-25T10:27:57Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-25T10:27:57Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38652", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01, 511, 0 - 3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi->devs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet's add one byte space for sbi->devs.path[] to store null\ncharacter of device path string.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38652" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e", "url": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d", "url": "https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136", "url": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e", "url": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea", "url": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0", "url": "https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd", "url": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa", "url": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80", "url": "https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-08-22T16:00:56Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-08-22T16:00:56Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53270", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc->scheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc->sched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53270" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33", "url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b", "url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03", "url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3", "url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5", "url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69", "url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06", "url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8", "url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8" } ], "release_date": "2026-06-25T08:39:55Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:39:55Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-38588", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix possible use-after-free issue in ftrace_location()\n\nKASAN reports a bug:\n\n BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\n Read of size 8 at addr ffff888141d40010 by task insmod/424\n CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+\n [...]\n Call Trace:\n \n dump_stack_lvl+0x68/0xa0\n print_report+0xcf/0x610\n kasan_report+0xb5/0xe0\n ftrace_location+0x90/0x120\n register_kprobe+0x14b/0xa40\n kprobe_init+0x2d/0xff0 [kprobe_example]\n do_one_initcall+0x8f/0x2d0\n do_init_module+0x13a/0x3c0\n load_module+0x3082/0x33d0\n init_module_from_file+0xd2/0x130\n __x64_sys_finit_module+0x306/0x440\n do_syscall_64+0x68/0x140\n entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause is that, in lookup_rec(), ftrace record of some address\nis being searched in ftrace pages of some module, but those ftrace pages\nat the same time is being freed in ftrace_release_mod() as the\ncorresponding module is being deleted:\n\n CPU1 | CPU2\n register_kprobes() { | delete_module() {\n check_kprobe_address_safe() { |\n arch_check_ftrace_location() { |\n ftrace_location() { |\n lookup_rec() // USE! | ftrace_release_mod() // Free!\n\nTo fix this issue:\n 1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\n 2. Use ftrace_location_range() instead of lookup_rec() in\n ftrace_location();\n 3. Call synchronize_rcu() before freeing any ftrace pages both in\n ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-38588" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd", "url": "https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b", "url": "https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6", "url": "https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461", "url": "https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831", "url": "https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada", "url": "https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d", "url": "https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b", "url": "https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-06-19T13:37:43Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-06-19T13:37:43Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38211", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix use-after-free of work objects after cm_id destruction\n\nThe commit 59c68ac31e15 (\"iw_cm: free cm_id resources on the last\nderef\") simplified cm_id resource management by freeing cm_id once all\nreferences to the cm_id were removed. The references are removed either\nupon completion of iw_cm event handlers or when the application destroys\nthe cm_id. This commit introduced the use-after-free condition where\ncm_id_private object could still be in use by event handler works during\nthe destruction of cm_id. The commit aee2424246f9 (\"RDMA/iwcm: Fix a\nuse-after-free related to destroying CM IDs\") addressed this use-after-\nfree by flushing all pending works at the cm_id destruction.\n\nHowever, still another use-after-free possibility remained. It happens\nwith the work objects allocated for each cm_id_priv within\nalloc_work_entries() during cm_id creation, and subsequently freed in\ndealloc_work_entries() once all references to the cm_id are removed.\nIf the cm_id's last reference is decremented in the event handler work,\nthe work object for the work itself gets removed, and causes the use-\nafter-free BUG below:\n\n BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250\n Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091\n\n CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n Workqueue: 0x0 (iw_cm_wq)\n Call Trace:\n \n dump_stack_lvl+0x6a/0x90\n print_report+0x174/0x554\n ? __virt_addr_valid+0x208/0x430\n ? __pwq_activate_work+0x1ff/0x250\n kasan_report+0xae/0x170\n ? __pwq_activate_work+0x1ff/0x250\n __pwq_activate_work+0x1ff/0x250\n pwq_dec_nr_in_flight+0x8c5/0xfb0\n process_one_work+0xc11/0x1460\n ? __pfx_process_one_work+0x10/0x10\n ? assign_work+0x16c/0x240\n worker_thread+0x5ef/0xfd0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x3b0/0x770\n ? __pfx_kthread+0x10/0x10\n ? rcu_is_watching+0x11/0xb0\n ? _raw_spin_unlock_irq+0x24/0x50\n ? rcu_is_watching+0x11/0xb0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x30/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n\n Allocated by task 147416:\n kasan_save_stack+0x2c/0x50\n kasan_save_track+0x10/0x30\n __kasan_kmalloc+0xa6/0xb0\n alloc_work_entries+0xa9/0x260 [iw_cm]\n iw_cm_connect+0x23/0x4a0 [iw_cm]\n rdma_connect_locked+0xbfd/0x1920 [rdma_cm]\n nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma]\n cma_cm_event_handler+0xae/0x320 [rdma_cm]\n cma_work_handler+0x106/0x1b0 [rdma_cm]\n process_one_work+0x84f/0x1460\n worker_thread+0x5ef/0xfd0\n kthread+0x3b0/0x770\n ret_from_fork+0x30/0x70\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 147091:\n kasan_save_stack+0x2c/0x50\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kfree+0x13a/0x4b0\n dealloc_work_entries+0x125/0x1f0 [iw_cm]\n iwcm_deref_id+0x6f/0xa0 [iw_cm]\n cm_work_handler+0x136/0x1ba0 [iw_cm]\n process_one_work+0x84f/0x1460\n worker_thread+0x5ef/0xfd0\n kthread+0x3b0/0x770\n ret_from_fork+0x30/0x70\n ret_from_fork_asm+0x1a/0x30\n\n Last potentially related work creation:\n kasan_save_stack+0x2c/0x50\n kasan_record_aux_stack+0xa3/0xb0\n __queue_work+0x2ff/0x1390\n queue_work_on+0x67/0xc0\n cm_event_handler+0x46a/0x820 [iw_cm]\n siw_cm_upcall+0x330/0x650 [siw]\n siw_cm_work_handler+0x6b9/0x2b20 [siw]\n process_one_work+0x84f/0x1460\n worker_thread+0x5ef/0xfd0\n kthread+0x3b0/0x770\n ret_from_fork+0x30/0x70\n ret_from_fork_asm+0x1a/0x30\n\nThis BUG is reproducible by repeating the blktests test case nvme/061\nfor the rdma transport and the siw driver.\n\nTo avoid the use-after-free of cm_id_private work objects, ensure that\nthe last reference to the cm_id is decremented not in the event handler\nworks, but in the cm_id destruction context. For that purpose, mo\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38211" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/013dcdf6f03bcedbaf1669e3db71c34a197715b2", "url": "https://git.kernel.org/stable/c/013dcdf6f03bcedbaf1669e3db71c34a197715b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23a707bbcbea468eedb398832eeb7e8e0ceafd21", "url": "https://git.kernel.org/stable/c/23a707bbcbea468eedb398832eeb7e8e0ceafd21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b4a50d733acad6831f6bd9288a76a80f70650ac", "url": "https://git.kernel.org/stable/c/3b4a50d733acad6831f6bd9288a76a80f70650ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6883b680e703c6b2efddb4e7a8d891ce1803d06b", "url": "https://git.kernel.org/stable/c/6883b680e703c6b2efddb4e7a8d891ce1803d06b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/764c9f69beabef8bdc651a7746c59f7a340d104f", "url": "https://git.kernel.org/stable/c/764c9f69beabef8bdc651a7746c59f7a340d104f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78381dc8a6b61c9bb9987d37b4d671b99767c4a1", "url": "https://git.kernel.org/stable/c/78381dc8a6b61c9bb9987d37b4d671b99767c4a1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf7eff5e3a36c54bbe8aff7fd6dd7c07490b81c5", "url": "https://git.kernel.org/stable/c/bf7eff5e3a36c54bbe8aff7fd6dd7c07490b81c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd960b5ddf4faf00da43babdd3acda68842e1f6a", "url": "https://git.kernel.org/stable/c/fd960b5ddf4faf00da43babdd3acda68842e1f6a" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-04T13:37:30Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-04T13:37:30Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37796", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x: fix use after free access in at76_disconnect\n\nThe memory pointed to by priv is freed at the end of at76_delete_device\nfunction (using ieee80211_free_hw). But the code then accesses the udev\nfield of the freed object to put the USB device. This may also lead to a\nmemory leak of the usb device. Fix this by using udev from interface.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37796" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546", "url": "https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da", "url": "https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5", "url": "https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c", "url": "https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f", "url": "https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704", "url": "https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9", "url": "https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6", "url": "https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-01T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-01T14:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56603", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_can: do not leave a dangling sk pointer in can_create()\n\nOn error can_create() frees the allocated sk object, but sock_init_data()\nhas already attached it to the provided sock object. This will leave a\ndangling sk pointer in the sock object and may cause use-after-free later.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56603" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1fe625f12d090d69f3f084990c7e4c1ff94bfe5f", "url": "https://git.kernel.org/stable/c/1fe625f12d090d69f3f084990c7e4c1ff94bfe5f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5947c9ac08f0771ea8ed64186b0d52e9029cb6c0", "url": "https://git.kernel.org/stable/c/5947c9ac08f0771ea8ed64186b0d52e9029cb6c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/811a7ca7320c062e15d0f5b171fe6ad8592d1434", "url": "https://git.kernel.org/stable/c/811a7ca7320c062e15d0f5b171fe6ad8592d1434" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425c", "url": "https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8df832e6b945e1ba61467d7f1c9305e314ae92fe", "url": "https://git.kernel.org/stable/c/8df832e6b945e1ba61467d7f1c9305e314ae92fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ce39b5576785bb3e66591145aad03d66bc3e778d", "url": "https://git.kernel.org/stable/c/ce39b5576785bb3e66591145aad03d66bc3e778d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db207d19adbac96058685f6257720906ad41d215", "url": "https://git.kernel.org/stable/c/db207d19adbac96058685f6257720906ad41d215" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T14:51:08Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T14:51:08Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52434", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n BUG: unable to handle page fault for address: ffff8881178d8cc3\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 4a01067 P4D 4a01067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7\n 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n PKRU: 55555554\n Call Trace:\n \n ? __die+0x23/0x70\n ? page_fault_oops+0x181/0x480\n ? search_module_extables+0x19/0x60\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? exc_page_fault+0x1b6/0x1c0\n ? asm_exc_page_fault+0x26/0x30\n ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n SMB2_open+0x38d/0x5f0 [cifs]\n ? smb2_is_path_accessible+0x138/0x260 [cifs]\n smb2_is_path_accessible+0x138/0x260 [cifs]\n cifs_is_path_remote+0x8d/0x230 [cifs]\n cifs_mount+0x7e/0x350 [cifs]\n cifs_smb3_do_mount+0x128/0x780 [cifs]\n smb3_get_tree+0xd9/0x290 [cifs]\n vfs_get_tree+0x2c/0x100\n ? capable+0x37/0x70\n path_mount+0x2d7/0xb80\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __x64_sys_mount+0x11a/0x150\n do_syscall_64+0x47/0xf0\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n RIP: 0033:0x7f8737657b1e", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52434" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "url": "https://git.kernel.org/stable/c/13fb0fc4917621f3dfa285a27eaf7151d770b5e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa", "url": "https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "url": "https://git.kernel.org/stable/c/1ae3c59355dc9882e09c020afe8ffbd895ad0f29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6726429c18c62dbf5e96ebbd522f262e016553fb", "url": "https://git.kernel.org/stable/c/6726429c18c62dbf5e96ebbd522f262e016553fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/890bc4fac3c0973a49cac35f634579bebba7fe48", "url": "https://git.kernel.org/stable/c/890bc4fac3c0973a49cac35f634579bebba7fe48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af1689a9b7701d9907dfc84d2a4b57c4bc907144", "url": "https://git.kernel.org/stable/c/af1689a9b7701d9907dfc84d2a4b57c4bc907144" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250117-0009/", "url": "https://security.netapp.com/advisory/ntap-20250117-0009/" } ], "release_date": "2024-02-20T18:04:44Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-02-20T18:04:44Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56640", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix LGR and link use-after-free issue\n\nWe encountered a LGR/link use-after-free issue, which manifested as\nthe LGR/link refcnt reaching 0 early and entering the clear process,\nmaking resource access unsafe.\n\n refcount_t: addition on 0; use-after-free.\n WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140\n Workqueue: events smc_lgr_terminate_work [smc]\n Call trace:\n refcount_warn_saturate+0x9c/0x140\n __smc_lgr_terminate.part.45+0x2a8/0x370 [smc]\n smc_lgr_terminate_work+0x28/0x30 [smc]\n process_one_work+0x1b8/0x420\n worker_thread+0x158/0x510\n kthread+0x114/0x118\n\nor\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140\n Workqueue: smc_hs_wq smc_listen_work [smc]\n Call trace:\n refcount_warn_saturate+0xf0/0x140\n smcr_link_put+0x1cc/0x1d8 [smc]\n smc_conn_free+0x110/0x1b0 [smc]\n smc_conn_abort+0x50/0x60 [smc]\n smc_listen_find_device+0x75c/0x790 [smc]\n smc_listen_work+0x368/0x8a0 [smc]\n process_one_work+0x1b8/0x420\n worker_thread+0x158/0x510\n kthread+0x114/0x118\n\nIt is caused by repeated release of LGR/link refcnt. One suspect is that\nsmc_conn_free() is called repeatedly because some smc_conn_free() from\nserver listening path are not protected by sock lock.\n\ne.g.\n\nCalls under socklock | smc_listen_work\n-------------------------------------------------------\nlock_sock(sk) | smc_conn_abort\nsmc_conn_free | \\- smc_conn_free\n\\- smcr_link_put | \\- smcr_link_put (duplicated)\nrelease_sock(sk)\n\nSo here add sock lock protection in smc_listen_work() path, making it\nexclusive with other connection operations.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56640" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0cf598548a6c36d90681d53c6b77d52363f2f295", "url": "https://git.kernel.org/stable/c/0cf598548a6c36d90681d53c6b77d52363f2f295" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7", "url": "https://git.kernel.org/stable/c/2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/673d606683ac70bc074ca6676b938bff18635226", "url": "https://git.kernel.org/stable/c/673d606683ac70bc074ca6676b938bff18635226" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f0ae06a234a78ae137064f2c89135ac078a00eb", "url": "https://git.kernel.org/stable/c/6f0ae06a234a78ae137064f2c89135ac078a00eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f502a88fdd415647a1f2dc45fac71b9c522a052b", "url": "https://git.kernel.org/stable/c/f502a88fdd415647a1f2dc45fac71b9c522a052b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" } ], "release_date": "2024-12-27T15:02:42Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T15:02:42Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23099", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: limit BOND_MODE_8023AD to Ethernet devices\n\nBOND_MODE_8023AD makes sense for ARPHRD_ETHER only.\n\nsyzbot reported:\n\n BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\nRead of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497\n\nCPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full)\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200\n __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\n __dev_mc_add net/core/dev_addr_lists.c:868 [inline]\n dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886\n bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180\n do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963\n do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165\n rtnl_changelink net/core/rtnetlink.c:3776 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3935 [inline]\n rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072\n rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n ____sys_sendmsg+0x505/0x820 net/socket.c:2592\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646\n __sys_sendmsg+0x164/0x220 net/socket.c:2678\n do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307\n do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n \n\nThe buggy address belongs to the variable:\n lacpdu_mcast_addr+0x0/0x40", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23099" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19266182b82e9100c799d8a29f5e0452f0bf7703", "url": "https://git.kernel.org/stable/c/19266182b82e9100c799d8a29f5e0452f0bf7703" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43dee6f7ef1d228821de1b61c292af3744c8d7da", "url": "https://git.kernel.org/stable/c/43dee6f7ef1d228821de1b61c292af3744c8d7da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5063b2cd9b27d35ab788d707d7858ded0acc8f1d", "url": "https://git.kernel.org/stable/c/5063b2cd9b27d35ab788d707d7858ded0acc8f1d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72925dbb0c8c7b16bf922e93c6cc03cbd8c955c4", "url": "https://git.kernel.org/stable/c/72925dbb0c8c7b16bf922e93c6cc03cbd8c955c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80c881e53a4fa0a80fa4bef7bc0ead0e8e88940d", "url": "https://git.kernel.org/stable/c/80c881e53a4fa0a80fa4bef7bc0ead0e8e88940d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6", "url": "https://git.kernel.org/stable/c/c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef68afb1bee8d35a18896c27d7358079353d8d8a", "url": "https://git.kernel.org/stable/c/ef68afb1bee8d35a18896c27d7358079353d8d8a" } ], "release_date": "2026-02-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-26689", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: prevent use-after-free in encode_cap_msg()\n\nIn fs/ceph/caps.c, in encode_cap_msg(), \"use after free\" error was\ncaught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This\nimplies before the refcount could be increment here, it was freed.\n\nIn same file, in \"handle_cap_grant()\" refcount is decremented by this\nline - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race\noccurred and resource was freed by the latter line before the former\nline could increment it.\n\nencode_cap_msg() is called by __send_cap() and __send_cap() is called by\nceph_check_caps() after calling __prep_cap(). __prep_cap() is where\narg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where\nthe refcount must be increased to prevent \"use after free\" error.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26689" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/70e329b440762390258a6fe8c0de93c9fdd56c77", "url": "https://git.kernel.org/stable/c/70e329b440762390258a6fe8c0de93c9fdd56c77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7958c1bf5b03c6f1f58e724dbdec93f8f60b96fc", "url": "https://git.kernel.org/stable/c/7958c1bf5b03c6f1f58e724dbdec93f8f60b96fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8180d0c27b93a6eb60da1b08ea079e3926328214", "url": "https://git.kernel.org/stable/c/8180d0c27b93a6eb60da1b08ea079e3926328214" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae20db45e482303a20e56f2db667a9d9c54ac7e7", "url": "https://git.kernel.org/stable/c/ae20db45e482303a20e56f2db667a9d9c54ac7e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cda4672da1c26835dcbd7aec2bfed954eda9b5ef", "url": "https://git.kernel.org/stable/c/cda4672da1c26835dcbd7aec2bfed954eda9b5ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3f98d7d84b31828004545e29fd7262b9f444139", "url": "https://git.kernel.org/stable/c/f3f98d7d84b31828004545e29fd7262b9f444139" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "release_date": "2024-04-03T14:54:50Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-04-03T14:54:50Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-43945", "cwe": { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size" }, "notes": [ { "category": "description", "text": "The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-43945" }, { "category": "external", "summary": "http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html", "url": "http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html" }, { "category": "external", "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f90497a16e434c2211c66e3de8e77b17868382b8", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f90497a16e434c2211c66e3de8e77b17868382b8" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221215-0006/", "url": "https://security.netapp.com/advisory/ntap-20221215-0006/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2022-11-04T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2022-11-04T19:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53510", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix handling of lrbp->cmd\n\nufshcd_queuecommand() may be called two times in a row for a SCSI command\nbefore it is completed. Hence make the following changes:\n\n - In the functions that submit a command, do not check the old value of\n lrbp->cmd nor clear lrbp->cmd in error paths.\n\n - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.\n\nSee also scsi_send_eh_cmnd().\n\nThis commit prevents that the following appears if a command times out:\n\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\nCall trace:\n ufshcd_queuecommand+0x6f8/0x9a8\n scsi_send_eh_cmnd+0x2c0/0x960\n scsi_eh_test_devices+0x100/0x314\n scsi_eh_ready_devs+0xd90/0x114c\n scsi_error_handler+0x2b4/0xb70\n kthread+0x16c/0x1e0", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53510" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b", "url": "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770", "url": "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5", "url": "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1", "url": "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1" } ], "release_date": "2025-10-01T11:45:59Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-01T11:45:59Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56602", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56602" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb", "url": "https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f", "url": "https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9", "url": "https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8", "url": "https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65", "url": "https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d", "url": "https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754", "url": "https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "release_date": "2024-12-27T14:51:08Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T14:51:08Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-52934", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tvlv: reject oversized TVLV packets\n\nbatadv_tvlv_container_ogm_append() builds a TVLV packet section from\nthe tvlv.container_list. The total size of this section is computed by\nbatadv_tvlv_container_list_size(), which sums the sizes of all registered\ncontainers.\n\nThe return type and accumulator in batadv_tvlv_container_list_size() were\nu16. If the accumulated size exceeds U16_MAX, the value wraps around,\ncausing the subsequent allocation in batadv_tvlv_container_ogm_append()\nto be undersized. The memcpy-style copy that follows would then write\nbeyond the end of the allocated buffer, corrupting kernel memory.\n\nFix this by widening the return type of batadv_tvlv_container_list_size()\nto size_t. In batadv_tvlv_container_ogm_append(), check the computed length\nagainst U16_MAX before proceeding, and bail out as if the allocation had\nfailed when the limit is exceeded.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52934" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482", "url": "https://git.kernel.org/stable/c/13493b00dd1e05a705981e052158652ea23eb482" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04", "url": "https://git.kernel.org/stable/c/1595628a2f877d052eda18865ccf539392c47c04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d", "url": "https://git.kernel.org/stable/c/6448a49344e87487b61bd88cb850cd694a0f576d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557", "url": "https://git.kernel.org/stable/c/94a3d72cd9b21116d7c6d5bdc57c11401fc28557" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171", "url": "https://git.kernel.org/stable/c/94db72e9dac202e017ee3db22c59d17e4f3bf171" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae", "url": "https://git.kernel.org/stable/c/c02aa6c0c9d1bea9bb75dea362b75ad225137bae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919", "url": "https://git.kernel.org/stable/c/ede47988ac5687793745b17c1634a496a2299919" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab", "url": "https://git.kernel.org/stable/c/f50487e3566358b2b982b7801945e858c78ad9ab" } ], "release_date": "2026-06-24T07:14:25Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T07:14:25Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37798", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncodel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()\n\nAfter making all ->qlen_notify() callbacks idempotent, now it is safe to\nremove the check of qlen!=0 from both fq_codel_dequeue() and\ncodel_qdisc_dequeue().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37798" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f9761a94bae33d26e6a81b31b36e7d776d93dc1", "url": "https://git.kernel.org/stable/c/2f9761a94bae33d26e6a81b31b36e7d776d93dc1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/342debc12183b51773b3345ba267e9263bdfaaef", "url": "https://git.kernel.org/stable/c/342debc12183b51773b3345ba267e9263bdfaaef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d55144b12e742404bb3f8fee6038bafbf45619d", "url": "https://git.kernel.org/stable/c/4d55144b12e742404bb3f8fee6038bafbf45619d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a742a9506849d1c1aa71e36c89855ceddc7d58e", "url": "https://git.kernel.org/stable/c/7a742a9506849d1c1aa71e36c89855ceddc7d58e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/829c49b6b2ff45b043739168fd1245e4e1a91a30", "url": "https://git.kernel.org/stable/c/829c49b6b2ff45b043739168fd1245e4e1a91a30" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31", "url": "https://git.kernel.org/stable/c/a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc71a757da78dd4aa1b4a9b19cb011833730ccf2", "url": "https://git.kernel.org/stable/c/cc71a757da78dd4aa1b4a9b19cb011833730ccf2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e73c838c80dccb9e4f19becc11d9f3cb4a27d483", "url": "https://git.kernel.org/stable/c/e73c838c80dccb9e4f19becc11d9f3cb4a27d483" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450", "url": "https://git.kernel.org/stable/c/eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-05-02T14:16:02Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-02T14:16:02Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-71091", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_override_port_prio_changed()\n\nThere has been a syzkaller bug reported recently with the following\ntrace:\n\nlist_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:59!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59\nCode: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d49f370 EFLAGS: 00010286\nRAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000\nRDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005\nRBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230\nR13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480\nFS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0\nCall Trace:\n \n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:223 [inline]\n list_del_rcu include/linux/rculist.h:178 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]\n team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]\n team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534\n team_option_set drivers/net/team/team_core.c:376 [inline]\n team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653\n genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684\n __sys_sendmsg+0x16d/0x220 net/socket.c:2716\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe problem is in this flow:\n1) Port is enabled, queue_id != 0, in qom_list\n2) Port gets disabled\n -> team_port_disable()\n -> team_queue_override_port_del()\n -> del (removed from list)\n3) Port is disabled, queue_id != 0, not in any list\n4) Priority changes\n -> team_queue_override_port_prio_changed()\n -> checks: port disabled && queue_id != 0\n -> calls del - hits the BUG as it is removed already\n\nTo fix this, change the check in team_queue_override_port_prio_changed()\nso it returns early if port is not enabled.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71091" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/107d245f84cb4f55f597d31eda34b42a2b7d6952", "url": "https://git.kernel.org/stable/c/107d245f84cb4f55f597d31eda34b42a2b7d6952" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25029e813c4aae5fcf7118e8dd5c56e382b9a1a3", "url": "https://git.kernel.org/stable/c/25029e813c4aae5fcf7118e8dd5c56e382b9a1a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53a727a8bfd78c739e130a781192d0f6f8e03d39", "url": "https://git.kernel.org/stable/c/53a727a8bfd78c739e130a781192d0f6f8e03d39" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6bfb62b6010a16112dcae52f490e5e0e6abe12a3", "url": "https://git.kernel.org/stable/c/6bfb62b6010a16112dcae52f490e5e0e6abe12a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/932ac51d9953eaf77a1252f79b656d4ca86163c6", "url": "https://git.kernel.org/stable/c/932ac51d9953eaf77a1252f79b656d4ca86163c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b71187648ef2349254673d0523fdf96d1fe3d758", "url": "https://git.kernel.org/stable/c/b71187648ef2349254673d0523fdf96d1fe3d758" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f820e438b8ec2a8354e70e75145f05fe45500d97", "url": "https://git.kernel.org/stable/c/f820e438b8ec2a8354e70e75145f05fe45500d97" } ], "release_date": "2026-01-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-13T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-71093", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ne1000: fix OOB in e1000_tbi_should_accept()\n\nIn e1000_tbi_should_accept() we read the last byte of the frame via\n'data[length - 1]' to evaluate the TBI workaround. If the descriptor-\nreported length is zero or larger than the actual RX buffer size, this\nread goes out of bounds and can hit unrelated slab objects. The issue\nis observed from the NAPI receive path (e1000_clean_rx_irq):\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790\nRead of size 1 at addr ffff888014114e54 by task sshd/363\n\nCPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x5a/0x74\n print_address_description+0x7b/0x440\n print_report+0x101/0x200\n kasan_report+0xc1/0xf0\n e1000_tbi_should_accept+0x610/0x790\n e1000_clean_rx_irq+0xa8c/0x1110\n e1000_clean+0xde2/0x3c10\n __napi_poll+0x98/0x380\n net_rx_action+0x491/0xa20\n __do_softirq+0x2c9/0x61d\n do_softirq+0xd1/0x120\n \n \n __local_bh_enable_ip+0xfe/0x130\n ip_finish_output2+0x7d5/0xb00\n __ip_queue_xmit+0xe24/0x1ab0\n __tcp_transmit_skb+0x1bcb/0x3340\n tcp_write_xmit+0x175d/0x6bd0\n __tcp_push_pending_frames+0x7b/0x280\n tcp_sendmsg_locked+0x2e4f/0x32d0\n tcp_sendmsg+0x24/0x40\n sock_write_iter+0x322/0x430\n vfs_write+0x56c/0xa60\n ksys_write+0xd1/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f511b476b10\nCode: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24\nRSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10\nRDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003\nRBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00\nR10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003\n \nAllocated by task 1:\n __kasan_krealloc+0x131/0x1c0\n krealloc+0x90/0xc0\n add_sysfs_param+0xcb/0x8a0\n kernel_add_sysfs_param+0x81/0xd4\n param_sysfs_builtin+0x138/0x1a6\n param_sysfs_init+0x57/0x5b\n do_one_initcall+0x104/0x250\n do_initcall_level+0x102/0x132\n do_initcalls+0x46/0x74\n kernel_init_freeable+0x28f/0x393\n kernel_init+0x14/0x1a0\n ret_from_fork+0x22/0x30\nThe buggy address belongs to the object at ffff888014114000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1620 bytes to the right of\n 2048-byte region [ffff888014114000, ffff888014114800]\nThe buggy address belongs to the physical page:\npage:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110\nhead:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head|node=0|zone=1)\nraw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000\nraw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n==================================================================\n\nThis happens because the TBI check unconditionally dereferences the last\nbyte without validating the reported length first:\n\n\tu8 last_byte = *(data + length - 1);\n\nFix by rejecting the frame early if the length is zero, or if it exceeds\nadapter->rx_buffer_len. This preserves the TBI workaround semantics for\nvalid frames and prevents touching memory beyond the RX buffer.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71093" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26c8bebc2f25288c2bcac7bc0a7662279a0e817c", "url": "https://git.kernel.org/stable/c/26c8bebc2f25288c2bcac7bc0a7662279a0e817c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/278b7cfe0d4da7502c7fd679b15032f014c92892", "url": "https://git.kernel.org/stable/c/278b7cfe0d4da7502c7fd679b15032f014c92892" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c4c0c09f9648ba766d399917d420d03e7b3e1f8", "url": "https://git.kernel.org/stable/c/2c4c0c09f9648ba766d399917d420d03e7b3e1f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ccfa56f272241e8d8e2c38191fdbb03df489d80", "url": "https://git.kernel.org/stable/c/4ccfa56f272241e8d8e2c38191fdbb03df489d80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c72a5182ed92904d01057f208c390a303f00a0f", "url": "https://git.kernel.org/stable/c/9c72a5182ed92904d01057f208c390a303f00a0f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad7a2a45e2417ac54089926b520924f8f0d91aea", "url": "https://git.kernel.org/stable/c/ad7a2a45e2417ac54089926b520924f8f0d91aea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee7c125fb3e8b04dd46510130b9fc92380e5d578", "url": "https://git.kernel.org/stable/c/ee7c125fb3e8b04dd46510130b9fc92380e5d578" } ], "release_date": "2026-01-13T15:34:53Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-01-13T15:34:53Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31787", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n - xen_unmap_domain_gfn_range()\n - xen_free_unpopulated_pages()\n - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31787" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5", "url": "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a", "url": "https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f", "url": "https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808", "url": "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95", "url": "https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0", "url": "https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850", "url": "https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4", "url": "https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/14", "url": "http://www.openwall.com/lists/oss-security/2026/04/28/14" }, { "category": "external", "summary": "http://xenbits.xen.org/xsa/advisory-487.html", "url": "http://xenbits.xen.org/xsa/advisory-487.html" } ], "release_date": "2026-04-30T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-30T11:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31659", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject oversized global TT response buffers\n\nbatadv_tt_prepare_tvlv_global_data() builds the allocation length for a\nglobal TT response in 16-bit temporaries. When a remote originator\nadvertises a large enough global TT, the TT payload length plus the VLAN\nheader offset can exceed 65535 and wrap before kmalloc().\n\nThe full-table response path still uses the original TT payload length when\nit fills tt_change, so the wrapped allocation is too small and\nbatadv_tt_prepare_tvlv_global_data() writes past the end of the heap object\nbefore the later packet-size check runs.\n\nFix this by rejecting TT responses whose TVLV value length cannot fit in\nthe 16-bit TVLV payload length field.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa", "url": "https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6", "url": "https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062", "url": "https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897", "url": "https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3", "url": "https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9", "url": "https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10", "url": "https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9", "url": "https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9" } ], "release_date": "2026-04-24T14:45:10Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:45:10Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-37932", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_htb: make htb_qlen_notify() idempotent\n\nhtb_qlen_notify() always deactivates the HTB class and in fact could\ntrigger a warning if it is already deactivated. Therefore, it is not\nidempotent and not friendly to its callers, like fq_codel_dequeue().\n\nLet's make it idempotent to ease qdisc_tree_reduce_backlog() callers'\nlife.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-37932" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a188c0e197383683fd093ab1ea6ce9a5869a6ea", "url": "https://git.kernel.org/stable/c/0a188c0e197383683fd093ab1ea6ce9a5869a6ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32ae12ce6a9f6bace186ca7335220ff59b6cc3cd", "url": "https://git.kernel.org/stable/c/32ae12ce6a9f6bace186ca7335220ff59b6cc3cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ba8b837b522d7051ef81bacf3d95383ff8edce5", "url": "https://git.kernel.org/stable/c/5ba8b837b522d7051ef81bacf3d95383ff8edce5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/73cf6af13153d62f9b76eff422eea79dbc70f15e", "url": "https://git.kernel.org/stable/c/73cf6af13153d62f9b76eff422eea79dbc70f15e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/967955c9e57f8eebfccc298037d4aaf3d42bc1c9", "url": "https://git.kernel.org/stable/c/967955c9e57f8eebfccc298037d4aaf3d42bc1c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a61f1b5921761fbaf166231418bc1db301e5bf59", "url": "https://git.kernel.org/stable/c/a61f1b5921761fbaf166231418bc1db301e5bf59" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bbbf5e0f87078b715e7a665d662a2c0e77f044ae", "url": "https://git.kernel.org/stable/c/bbbf5e0f87078b715e7a665d662a2c0e77f044ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6b45f4de763b00dc1c55e685e2dd1aaf525d3c1", "url": "https://git.kernel.org/stable/c/e6b45f4de763b00dc1c55e685e2dd1aaf525d3c1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-05-20T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-20T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2022-50422", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n\nWhen executing SMP task failed, the smp_execute_task_sg() calls del_timer()\nto delete \"slow_task->timer\". However, if the timer handler\nsas_task_internal_timedout() is running, the del_timer() in\nsmp_execute_task_sg() will not stop it and a UAF will happen. The process\nis shown below:\n\n (thread 1) | (thread 2)\nsmp_execute_task_sg() | sas_task_internal_timedout()\n ... |\n del_timer() |\n ... | ...\n sas_free_task(task) |\n kfree(task->slow_task) //FREE|\n | task->slow_task->... //USE\n\nFix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure\nthe timer handler have finished before the \"task->slow_task\" is\ndeallocated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50422" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/117331a2a5227fb4369c2a1f321d3e3e2e2ef8fe", "url": "https://git.kernel.org/stable/c/117331a2a5227fb4369c2a1f321d3e3e2e2ef8fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e12ce270f0d926085c1209cc90397e307deef97", "url": "https://git.kernel.org/stable/c/2e12ce270f0d926085c1209cc90397e307deef97" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46ba53c30666717cb06c2b3c5d896301cd00d0c0", "url": "https://git.kernel.org/stable/c/46ba53c30666717cb06c2b3c5d896301cd00d0c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9e5176ead6de64f572ad5c87a72825d9d3c82ae", "url": "https://git.kernel.org/stable/c/a9e5176ead6de64f572ad5c87a72825d9d3c82ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e45a1516d2933703a4823d9db71e17c3abeba24f", "url": "https://git.kernel.org/stable/c/e45a1516d2933703a4823d9db71e17c3abeba24f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7a785177611ffc97d645fcbc196e6de6ad2421d", "url": "https://git.kernel.org/stable/c/f7a785177611ffc97d645fcbc196e6de6ad2421d" } ], "release_date": "2025-10-01T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-01T12:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31597", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY\n\nfilemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY,\nas documented in mm/filemap.c:\n\n \"If our return value has VM_FAULT_RETRY set, it's because the mmap_lock\n may be dropped before doing I/O or by lock_folio_maybe_drop_mmap().\"\n\nWhen this happens, a concurrent munmap() can call remove_vma() and free\nthe vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then\nbecomes a dangling pointer, and the subsequent trace_ocfs2_fault() call\ndereferences it -- a use-after-free.\n\nFix this by saving ip_blkno as a plain integer before calling\nfilemap_fault(), and removing vma from the trace event. Since\nip_blkno is copied by value before the lock can be dropped, it\nremains valid regardless of what happens to the vma or inode\nafterward.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31597" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76", "url": "https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94", "url": "https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2", "url": "https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d", "url": "https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006", "url": "https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0", "url": "https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921", "url": "https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2", "url": "https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2", "url": "https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2" } ], "release_date": "2026-04-24T14:42:22Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:22Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-46731", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix the Out-of-bounds read warning\n\nusing index i - 1U may beyond element index\nfor mc_data[] when i = 0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-46731" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12c6967428a099bbba9dfd247bb4322a984fcc0b", "url": "https://git.kernel.org/stable/c/12c6967428a099bbba9dfd247bb4322a984fcc0b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/20c6373a6be93039f9d66029bb1e21038a060be1", "url": "https://git.kernel.org/stable/c/20c6373a6be93039f9d66029bb1e21038a060be1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3317966efcdc5101e93db21514b68917e7eb34ea", "url": "https://git.kernel.org/stable/c/3317966efcdc5101e93db21514b68917e7eb34ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/38e32a0d837443c91c4b615a067b976cfb925376", "url": "https://git.kernel.org/stable/c/38e32a0d837443c91c4b615a067b976cfb925376" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d83fb9f9f63e9a120bf405b078f829f0b2e58934", "url": "https://git.kernel.org/stable/c/d83fb9f9f63e9a120bf405b078f829f0b2e58934" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1e261ced9bcad772a45a2fcdf413c3490e87299", "url": "https://git.kernel.org/stable/c/f1e261ced9bcad772a45a2fcdf413c3490e87299" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-09-18T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-09-18T07:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31581", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31581" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65", "url": "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185", "url": "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0", "url": "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386", "url": "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41", "url": "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c", "url": "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3", "url": "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af", "url": "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e", "url": "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e" } ], "release_date": "2026-04-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38068", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lzo - Fix compression buffer overrun\n\nUnlike the decompression code, the compression code in LZO never\nchecked for output overruns. It instead assumes that the caller\nalways provides enough buffer space, disregarding the buffer length\nprovided by the caller.\n\nAdd a safe compression interface that checks for the end of buffer\nbefore each write. Use the safe interface in crypto/lzo.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38068" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0acdc4d6e679ba31d01e3e7e2e4124b76d6d8e2a", "url": "https://git.kernel.org/stable/c/0acdc4d6e679ba31d01e3e7e2e4124b76d6d8e2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/167373d77c70c2b558aae3e327b115249bb2652c", "url": "https://git.kernel.org/stable/c/167373d77c70c2b558aae3e327b115249bb2652c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111", "url": "https://git.kernel.org/stable/c/4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7caad075acb634a74911830d6386c50ea12566cd", "url": "https://git.kernel.org/stable/c/7caad075acb634a74911830d6386c50ea12566cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a98bd864e16f91c70b2469adf013d713d04d1d13", "url": "https://git.kernel.org/stable/c/a98bd864e16f91c70b2469adf013d713d04d1d13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc47f07234f72cbd8e2c973cdbf2a6730660a463", "url": "https://git.kernel.org/stable/c/cc47f07234f72cbd8e2c973cdbf2a6730660a463" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-06-18T09:33:46Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T09:33:46Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43281", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = <0>;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43281" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "url": "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "url": "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8", "url": "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "url": "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "url": "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd", "url": "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "url": "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "url": "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310" } ], "release_date": "2026-05-06T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-06T12:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31576", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31576" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824", "url": "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b", "url": "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848", "url": "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258", "url": "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0", "url": "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6", "url": "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4", "url": "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9", "url": "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2", "url": "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2" } ], "release_date": "2026-04-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46208", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: stop tp_meter sessions during mesh teardown\n\nTP meter sessions remain linked on bat_priv->tp_list after the netlink\nrequest has already finished. When the mesh interface is removed,\nbatadv_mesh_free() currently tears down the mesh without first draining\nthese sessions.\n\nA running sender thread or a late incoming tp_meter packet can then keep\nprocessing against a mesh instance which is already shutting down.\nSynchronize tp_meter with the mesh lifetime by stopping all active\nsessions from batadv_mesh_free() and waiting for sender threads to exit\nbefore teardown continues.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46208" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03660dab86f93319178a24667f6998526dc4355d", "url": "https://git.kernel.org/stable/c/03660dab86f93319178a24667f6998526dc4355d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/268078acae72daa12b17b2b299701cb9924e469a", "url": "https://git.kernel.org/stable/c/268078acae72daa12b17b2b299701cb9924e469a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26dfeee8db81354bfdade155f27f9e16510ad196", "url": "https://git.kernel.org/stable/c/26dfeee8db81354bfdade155f27f9e16510ad196" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d3cf6a7314aca4df0a6dde28ce784a2a30d0166", "url": "https://git.kernel.org/stable/c/3d3cf6a7314aca4df0a6dde28ce784a2a30d0166" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58943b7ea356294749dae3e75b96c0ee292c00be", "url": "https://git.kernel.org/stable/c/58943b7ea356294749dae3e75b96c0ee292c00be" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e7d0ac936354c36810e74ac3056b334ed1f4058", "url": "https://git.kernel.org/stable/c/5e7d0ac936354c36810e74ac3056b334ed1f4058" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79bc0eaeef2c5797317bf2da8e3159a74d62ec47", "url": "https://git.kernel.org/stable/c/79bc0eaeef2c5797317bf2da8e3159a74d62ec47" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8634c1dbd73adb74d40533ebb7e914efb82e71fb", "url": "https://git.kernel.org/stable/c/8634c1dbd73adb74d40533ebb7e914efb82e71fb" } ], "release_date": "2026-05-28T09:40:26Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T09:40:26Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38565", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Exit early on perf_mmap() fail\n\nWhen perf_mmap() fails to allocate a buffer, it still invokes the\nevent_mapped() callback of the related event. On X86 this might increase\nthe perf_rdpmc_allowed reference counter. But nothing undoes this as\nperf_mmap_close() is never called in this case, which causes another\nreference count leak.\n\nReturn early on failure to prevent that.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38565" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07091aade394f690e7b655578140ef84d0e8d7b0", "url": "https://git.kernel.org/stable/c/07091aade394f690e7b655578140ef84d0e8d7b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/163b0d1a209fe0df5476c1df2330ca12b55abf92", "url": "https://git.kernel.org/stable/c/163b0d1a209fe0df5476c1df2330ca12b55abf92" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27d44145bd576bbef9bf6165bcd78128ec3e6cbd", "url": "https://git.kernel.org/stable/c/27d44145bd576bbef9bf6165bcd78128ec3e6cbd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ffda7f3ed76ec8defc19d985e33b3b82ba07839", "url": "https://git.kernel.org/stable/c/5ffda7f3ed76ec8defc19d985e33b3b82ba07839" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ff8521f30c4c2fcd4e88bd7640486602bf8a650", "url": "https://git.kernel.org/stable/c/7ff8521f30c4c2fcd4e88bd7640486602bf8a650" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92043120a2e992800580855498ab8507e1b22db9", "url": "https://git.kernel.org/stable/c/92043120a2e992800580855498ab8507e1b22db9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b90a48c7de828a15c7a4fc565d46999c6e22d6b", "url": "https://git.kernel.org/stable/c/9b90a48c7de828a15c7a4fc565d46999c6e22d6b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de85e72598d89880a02170a1cbc27b35a7d978a9", "url": "https://git.kernel.org/stable/c/de85e72598d89880a02170a1cbc27b35a7d978a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f41e9eba77bf97626e04296dc5677d02816d2432", "url": "https://git.kernel.org/stable/c/f41e9eba77bf97626e04296dc5677d02816d2432" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-08-19T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-08-19T17:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23191", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aloop: Fix racy access at PCM trigger\n\nThe PCM trigger callback of aloop driver tries to check the PCM state\nand stop the stream of the tied substream in the corresponding cable.\nSince both check and stop operations are performed outside the cable\nlock, this may result in UAF when a program attempts to trigger\nfrequently while opening/closing the tied stream, as spotted by\nfuzzers.\n\nFor addressing the UAF, this patch changes two things:\n- It covers the most of code in loopback_check_format() with\n cable->lock spinlock, and add the proper NULL checks. This avoids\n already some racy accesses.\n- In addition, now we try to check the state of the capture PCM stream\n that may be stopped in this function, which was the major pain point\n leading to UAF.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23191" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5727ccf9d19ca414cb76d9b647883822e2789c2e", "url": "https://git.kernel.org/stable/c/5727ccf9d19ca414cb76d9b647883822e2789c2e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/826af7fa62e347464b1b4e0ba2fe19a92438084f", "url": "https://git.kernel.org/stable/c/826af7fa62e347464b1b4e0ba2fe19a92438084f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bad15420050db1803767e58756114800cce91ea4", "url": "https://git.kernel.org/stable/c/bad15420050db1803767e58756114800cce91ea4" } ], "release_date": "2026-02-14T16:27:18Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-14T16:27:18Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23281", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix use-after-free in lbs_free_adapter()\n\nThe lbs_free_adapter() function uses timer_delete() (non-synchronous)\nfor both command_timer and tx_lockup_timer before the structure is\nfreed. This is incorrect because timer_delete() does not wait for\nany running timer callback to complete.\n\nIf a timer callback is executing when lbs_free_adapter() is called,\nthe callback will access freed memory since lbs_cfg_free() frees the\ncontaining structure immediately after lbs_free_adapter() returns.\n\nBoth timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)\naccess priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,\nwhich would all be use-after-free violations.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.\n\nThis bug was introduced in commit 8f641d93c38a (\"libertas: detect TX\nlockups and reset hardware\") where del_timer() was used instead of\ndel_timer_sync() in the cleanup path. The command_timer has had the\nsame issue since the driver was first written.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23281" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0", "url": "https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083", "url": "https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6", "url": "https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc", "url": "https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922", "url": "https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4", "url": "https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6", "url": "https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d", "url": "https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d" } ], "release_date": "2026-03-25T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-25T11:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50256", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()\n\nI got a syzbot report without a repro [1] crashing in nf_send_reset6()\n\nI think the issue is that dev->hard_header_len is zero, and we attempt\nlater to push an Ethernet header.\n\nUse LL_MAX_HEADER, as other functions in net/ipv6/netfilter/nf_reject_ipv6.c.\n\n[1]\n\nskbuff: skb_under_panic: text:ffffffff89b1d008 len:74 put:14 head:ffff88803123aa00 data:ffff88803123a9f2 tail:0x3c end:0x140 dev:syz_tun\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 7373 Comm: syz.1.568 Not tainted 6.12.0-rc2-syzkaller-00631-g6d858708d465 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0d 8d 48 c7 c6 60 a6 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 ba 30 38 02 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc900045269b0 EFLAGS: 00010282\nRAX: 0000000000000088 RBX: dffffc0000000000 RCX: cd66dacdc5d8e800\nRDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000\nRBP: ffff88802d39a3d0 R08: ffffffff8174afec R09: 1ffff920008a4ccc\nR10: dffffc0000000000 R11: fffff520008a4ccd R12: 0000000000000140\nR13: ffff88803123aa00 R14: ffff88803123a9f2 R15: 000000000000003c\nFS: 00007fdbee5ff6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000005d322000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n skb_push+0xe5/0x100 net/core/skbuff.c:2636\n eth_header+0x38/0x1f0 net/ethernet/eth.c:83\n dev_hard_header include/linux/netdevice.h:3208 [inline]\n nf_send_reset6+0xce6/0x1270 net/ipv6/netfilter/nf_reject_ipv6.c:358\n nft_reject_inet_eval+0x3b9/0x690 net/netfilter/nft_reject_inet.c:48\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288\n nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n nf_hook include/linux/netfilter.h:269 [inline]\n NF_HOOK include/linux/netfilter.h:312 [inline]\n br_nf_pre_routing_ipv6+0x63e/0x770 net/bridge/br_netfilter_ipv6.c:184\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]\n br_handle_frame+0x9fd/0x1530 net/bridge/br_input.c:424\n __netif_receive_skb_core+0x13e8/0x4570 net/core/dev.c:5562\n __netif_receive_skb_one_core net/core/dev.c:5666 [inline]\n __netif_receive_skb+0x12f/0x650 net/core/dev.c:5781\n netif_receive_skb_internal net/core/dev.c:5867 [inline]\n netif_receive_skb+0x1e8/0x890 net/core/dev.c:5926\n tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550\n tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007\n tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053\n new_sync_write fs/read_write.c:590 [inline]\n vfs_write+0xa6d/0xc90 fs/read_write.c:683\n ksys_write+0x183/0x2b0 fs/read_write.c:736\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdbeeb7d1ff\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48\nRSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff\nRDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8\nRBP: 00007fdbeebf12be R08: 0000000\n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50256" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ed234fe793f27a3b151c43d2106df2ff0d81aac", "url": "https://git.kernel.org/stable/c/4ed234fe793f27a3b151c43d2106df2ff0d81aac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f7b586aae53c2ed820661803da8ce18b1361921", "url": "https://git.kernel.org/stable/c/4f7b586aae53c2ed820661803da8ce18b1361921" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f85b057e34419e5ec0583a65078a11ccc1d4540a", "url": "https://git.kernel.org/stable/c/f85b057e34419e5ec0583a65078a11ccc1d4540a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fef63832317d9d24e1214cdd8f204d02ebdf8499", "url": "https://git.kernel.org/stable/c/fef63832317d9d24e1214cdd8f204d02ebdf8499" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-11-09T10:15:09Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-11-09T10:15:09Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-46813", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_index before accessing dc->links[]\n\n[WHY & HOW]\ndc->links[] has max size of MAX_LINKS and NULL is return when trying to\naccess with out-of-bound index.\n\nThis fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-46813" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/032c5407a608ac3b2a98bf4fbda27d12c20c5887", "url": "https://git.kernel.org/stable/c/032c5407a608ac3b2a98bf4fbda27d12c20c5887" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf", "url": "https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac04759b4a002969cf0f1384f1b8bb2001cfa782", "url": "https://git.kernel.org/stable/c/ac04759b4a002969cf0f1384f1b8bb2001cfa782" } ], "release_date": "2024-09-27T12:35:55Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-09-27T12:35:55Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23076", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix potential OOB access in audio mixer handling\n\nIn the audio mixer handling code of ctxfi driver, the conf field is\nused as a kind of loop index, and it's referred in the index callbacks\n(amixer_index() and sum_index()).\n\nAs spotted recently by fuzzers, the current code causes OOB access at\nthose functions.\n| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48\n| index 8 is out of range for type 'unsigned char [8]'\n\nAfter the analysis, the cause was found to be the lack of the proper\n(re-)initialization of conj field.\n\nThis patch addresses those OOB accesses by adding the proper\ninitializations of the loop indices.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23076" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276", "url": "https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae", "url": "https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c", "url": "https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174", "url": "https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38", "url": "https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf", "url": "https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c", "url": "https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c" } ], "release_date": "2026-02-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23083", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Don't allow 0 for FOU_ATTR_IPPROTO.\n\nfou_udp_recv() has the same problem mentioned in the previous\npatch.\n\nIf FOU_ATTR_IPPROTO is set to 0, skb is not freed by\nfou_udp_recv() nor \"resubmit\"-ted in ip_protocol_deliver_rcu().\n\nLet's forbid 0 for FOU_ATTR_IPPROTO.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23083" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1cc98b8887cabb1808d2f4a37cd10a7be7574771", "url": "https://git.kernel.org/stable/c/1cc98b8887cabb1808d2f4a37cd10a7be7574771" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/611ef4bd9c73d9e6d87bed57a635ff1fdd8c91ea", "url": "https://git.kernel.org/stable/c/611ef4bd9c73d9e6d87bed57a635ff1fdd8c91ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e983789b7588ee59cbf303583546c043bad8e19", "url": "https://git.kernel.org/stable/c/6e983789b7588ee59cbf303583546c043bad8e19" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5", "url": "https://git.kernel.org/stable/c/7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b75dff8446ec871030d8daf5a69e74f5fe8b956", "url": "https://git.kernel.org/stable/c/9b75dff8446ec871030d8daf5a69e74f5fe8b956" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7db31a52c3862a1a32202a273a4c32e7f5f4823", "url": "https://git.kernel.org/stable/c/b7db31a52c3862a1a32202a273a4c32e7f5f4823" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c7498f9bc390479ccfad7c7f2332237ff4945b03", "url": "https://git.kernel.org/stable/c/c7498f9bc390479ccfad7c7f2332237ff4945b03" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2026-02-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-04T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-53124", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix data-races around sk->sk_forward_alloc\n\nSyzkaller reported this warning:\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0\n Modules linked in:\n CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:inet_sock_destruct+0x1c5/0x1e0\n Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00\n RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206\n RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007\n RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00\n RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007\n R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00\n R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78\n FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n ? __warn+0x88/0x130\n ? inet_sock_destruct+0x1c5/0x1e0\n ? report_bug+0x18e/0x1a0\n ? handle_bug+0x53/0x90\n ? exc_invalid_op+0x18/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? inet_sock_destruct+0x1c5/0x1e0\n __sk_destruct+0x2a/0x200\n rcu_do_batch+0x1aa/0x530\n ? rcu_do_batch+0x13b/0x530\n rcu_core+0x159/0x2f0\n handle_softirqs+0xd3/0x2b0\n ? __pfx_smpboot_thread_fn+0x10/0x10\n run_ksoftirqd+0x25/0x30\n smpboot_thread_fn+0xdd/0x1d0\n kthread+0xd3/0x100\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n ---[ end trace 0000000000000000 ]---\n\nIts possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add()\nconcurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked,\nwhich triggers a data-race around sk->sk_forward_alloc:\ntcp_v6_rcv\n tcp_v6_do_rcv\n skb_clone_and_charge_r\n sk_rmem_schedule\n __sk_mem_schedule\n sk_forward_alloc_add()\n skb_set_owner_r\n sk_mem_charge\n sk_forward_alloc_add()\n __kfree_skb\n skb_release_all\n skb_release_head_state\n sock_rfree\n sk_mem_uncharge\n sk_forward_alloc_add()\n sk_mem_reclaim\n // set local var reclaimable\n __sk_mem_reclaim\n sk_forward_alloc_add()\n\nIn this syzkaller testcase, two threads call\ntcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like\nthis:\n (cpu 1) | (cpu 2) | sk_forward_alloc\n ... | ... | 0\n __sk_mem_schedule() | | +4096 = 4096\n | __sk_mem_schedule() | +4096 = 8192\n sk_mem_charge() | | -768 = 7424\n | sk_mem_charge() | -768 = 6656\n ... | ... |\n sk_mem_uncharge() | | +768 = 7424\n reclaimable=7424 | |\n | sk_mem_uncharge() | +768 = 8192\n | reclaimable=8192 |\n __sk_mem_reclaim() | | -4096 = 4096\n | __sk_mem_reclaim() | -8192 = -4096 != 0\n\nThe skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when\nsk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock().\nFix the same issue in dccp_v6_do_rcv().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-53124" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/073d89808c065ac4c672c0a613a71b27a80691cb", "url": "https://git.kernel.org/stable/c/073d89808c065ac4c672c0a613a71b27a80691cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f51f8c9d28954cf380100883a02eed35a8277e9", "url": "https://git.kernel.org/stable/c/3f51f8c9d28954cf380100883a02eed35a8277e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/695fb0b9aecfd5dd5b2946ba8897ac2c1eef654d", "url": "https://git.kernel.org/stable/c/695fb0b9aecfd5dd5b2946ba8897ac2c1eef654d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be7c61ea5f816168c38955eb4e898adc8b4b32fd", "url": "https://git.kernel.org/stable/c/be7c61ea5f816168c38955eb4e898adc8b4b32fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3d052cae566ec2285f5999958a5deb415a0f59e", "url": "https://git.kernel.org/stable/c/c3d052cae566ec2285f5999958a5deb415a0f59e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d285eb9d0641c8344f2836081b4ccb7b3c5cc1b6", "url": "https://git.kernel.org/stable/c/d285eb9d0641c8344f2836081b4ccb7b3c5cc1b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe2c0bd6d1e29ccefdc978b9a290571c93c27473", "url": "https://git.kernel.org/stable/c/fe2c0bd6d1e29ccefdc978b9a290571c93c27473" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-503939.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-503939.html" } ], "release_date": "2024-12-02T13:44:54Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-02T13:44:54Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-38545", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix UAF for cq async event\n\nThe refcount of CQ is not protected by locks. When CQ asynchronous\nevents and CQ destruction are concurrent, CQ may have been released,\nwhich will cause UAF.\n\nUse the xa_lock() to protect the CQ refcount.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-38545" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e", "url": "https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507", "url": "https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911", "url": "https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08", "url": "https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf", "url": "https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42", "url": "https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42" } ], "release_date": "2024-06-19T13:35:19Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-06-19T13:35:19Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53259", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF\n\nThe call to get_user_pages_fast() in vmci_host_setup_notify() can return\nNULL context->notify_page causing a GPF. To avoid GPF check if\ncontext->notify_page == NULL and return error if so.\n\ngeneral protection fault, probably for non-canonical address\n 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: maybe wild-memory-access in range [0x0005088000000300-\n 0x0005088000000307]\nCPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1\nHardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014\nRIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0\nCall Trace:\n \n vmci_host_unlocked_ioctl+0x362/0x1f40\n __x64_sys_ioctl+0x1a1/0x230\n do_syscall_64+0x3a/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53259" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/055891397f530f9b1b22be38d7eca8b08382941f", "url": "https://git.kernel.org/stable/c/055891397f530f9b1b22be38d7eca8b08382941f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a726cb47fd204109c767409fa9ca15a96328f14", "url": "https://git.kernel.org/stable/c/1a726cb47fd204109c767409fa9ca15a96328f14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1", "url": "https://git.kernel.org/stable/c/91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3c89e8c69a58f62451c0a75b77fcab25979b897", "url": "https://git.kernel.org/stable/c/a3c89e8c69a58f62451c0a75b77fcab25979b897" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4239bfb260d1e6837766c41a0b241d7670f1402", "url": "https://git.kernel.org/stable/c/b4239bfb260d1e6837766c41a0b241d7670f1402" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4198f67e7556b1507f14f60d81a72660e5560e4", "url": "https://git.kernel.org/stable/c/d4198f67e7556b1507f14f60d81a72660e5560e4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-09-15T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-15T15:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46033", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - reject short ahash digests during instance creation\n\nauthencesn requires either a zero authsize or an authsize of at least\n4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of\nhigh-order sequence number data at the end of the authenticated data.\n\nWhile crypto_authenc_esn_setauthsize() already rejects explicit\nnon-zero authsizes in the range 1..3, crypto_authenc_esn_create()\nstill copied auth->digestsize into inst->alg.maxauthsize without\nvalidating it. The AEAD core then initialized the tfm's default\nauthsize from that value.\n\nAs a result, selecting an ahash with digest size 1..3, such as\ncbcmac(cipher_null), exposed authencesn instances whose default\nauthsize was invalid even though setauthsize() would have rejected the\nsame value. AF_ALG could then trigger the ESN tail handling with a\ntoo-short tag and hit an out-of-bounds access.\n\nReject authencesn instances whose ahash digest size is in the invalid\nnon-zero range 1..3 so that no tfm can inherit an unsupported default\nauthsize.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46033" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726", "url": "https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0", "url": "https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88", "url": "https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9", "url": "https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b", "url": "https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476", "url": "https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3", "url": "https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0", "url": "https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46033", "url": "https://access.redhat.com/security/cve/CVE-2026-46033" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2482000", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482000" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46033.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46033.json" } ], "release_date": "2026-05-27T12:56:42Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-27T12:56:42Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23235", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix out-of-bounds access in sysfs attribute read/write\n\nSome f2fs sysfs attributes suffer from out-of-bounds memory access and\nincorrect handling of integer values whose size is not 4 bytes.\n\nFor example:\nvm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out\nvm:~# cat /sys/fs/f2fs/vde/carve_out\n65537\nvm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold\nvm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold\n1\n\ncarve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit\ninteger. However, the sysfs interface allows setting it to a value\nlarger than 255, resulting in an out-of-range update.\n\natgc_age_threshold maps to {struct atgc_management}->age_threshold,\nwhich is a 64-bit integer, but its sysfs interface cannot correctly set\nvalues larger than UINT_MAX.\n\nThe root causes are:\n1. __sbi_store() treats all default values as unsigned int, which\nprevents updating integers larger than 4 bytes and causes out-of-bounds\nwrites for integers smaller than 4 bytes.\n\n2. f2fs_sbi_show() also assumes all default values are unsigned int,\nleading to out-of-bounds reads and incorrect access to integers larger\nthan 4 bytes.\n\nThis patch introduces {struct f2fs_attr}->size to record the actual size\nof the integer associated with each sysfs attribute. With this\ninformation, sysfs read and write operations can correctly access and\nupdate values according to their real data size, avoiding memory\ncorruption and truncation.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23235" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703", "url": "https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240", "url": "https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002d", "url": "https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98", "url": "https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955", "url": "https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954", "url": "https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55a", "url": "https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32ce", "url": "https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32ce" } ], "release_date": "2026-03-04T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-03-04T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-43040", "cwe": { "id": "CWE-909", "name": "Missing Initialization of Resource" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43040" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05", "url": "https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c", "url": "https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648", "url": "https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4", "url": "https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d", "url": "https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f", "url": "https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c", "url": "https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67", "url": "https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-01T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38375", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38375" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8", "url": "https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73", "url": "https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58", "url": "https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c", "url": "https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b", "url": "https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651", "url": "https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef", "url": "https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1", "url": "https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-25T12:53:17Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-25T12:53:17Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52531", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: Fix a memory corruption issue\n\nA few lines above, space is kzalloc()'ed for:\n\tsizeof(struct iwl_nvm_data) +\n\tsizeof(struct ieee80211_channel) +\n\tsizeof(struct ieee80211_rate)\n\n'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.\n\nAt the end of this structure, there is the 'channels' flex array.\nEach element is of type 'struct ieee80211_channel'.\nSo only 1 element is allocated in this array.\n\nWhen doing:\n mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;\nWe point at the first element of the 'channels' flex array.\nSo this is fine.\n\nHowever, when doing:\n mvm->nvm_data->bands[0].bitrates =\n\t\t\t(void *)((u8 *)mvm->nvm_data->channels + 1);\nbecause of the \"(u8 *)\" cast, we add only 1 to the address of the beginning\nof the flex array.\n\nIt is likely that we want point at the 'struct ieee80211_rate' allocated\njust after.\n\nRemove the spurious casting so that the pointer arithmetic works as\nexpected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52531" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b3223449c959a8be94a1f042288059e40fcccb0", "url": "https://git.kernel.org/stable/c/6b3223449c959a8be94a1f042288059e40fcccb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c8faa31080342aec4903c9acb20caf82fcca1ef", "url": "https://git.kernel.org/stable/c/7c8faa31080342aec4903c9acb20caf82fcca1ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d", "url": "https://git.kernel.org/stable/c/8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f06cdd8d4ba5252986f51f80cc30263636397128", "url": "https://git.kernel.org/stable/c/f06cdd8d4ba5252986f51f80cc30263636397128" } ], "release_date": "2024-03-02T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-03-02T22:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-21546", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix WRITE_SAME No Data Buffer crash\n\nIn newer version of the SBC specs, we have a NDOB bit that indicates there\nis no data buffer that gets written out. If this bit is set using commands\nlike \"sg_write_same --ndob\" we will crash in target_core_iblock/file's\nexecute_write_same handlers when we go to access the se_cmd->t_data_sg\nbecause its NULL.\n\nThis patch adds a check for the NDOB bit in the common WRITE SAME code\nbecause we don't support it. And, it adds a check for zero SG elements in\neach handler in case the initiator tries to send a normal WRITE SAME with\nno data buffer.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-21546" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510", "url": "https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b", "url": "https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29", "url": "https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899", "url": "https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-05-02T21:52:09Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-02T21:52:09Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-56631", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Fix slab-use-after-free read in sg_release()\n\nFix a use-after-free bug in sg_release(), detected by syzbot with KASAN:\n\nBUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30\nkernel/locking/lockdep.c:5838\n__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912\nsg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407\n\nIn sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is\ncalled before releasing the open_rel_lock mutex. The kref_put() call may\ndecrement the reference count of sfp to zero, triggering its cleanup\nthrough sg_remove_sfp(). This cleanup includes scheduling deferred work\nvia sg_remove_sfp_usercontext(), which ultimately frees sfp.\n\nAfter kref_put(), sg_release() continues to unlock open_rel_lock and may\nreference sfp or sdp. If sfp has already been freed, this results in a\nslab-use-after-free error.\n\nMove the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the\nopen_rel_lock mutex. This ensures:\n\n - No references to sfp or sdp occur after the reference count is\n decremented.\n\n - Cleanup functions such as sg_remove_sfp() and\n sg_remove_sfp_usercontext() can safely execute without impacting the\n mutex handling in sg_release().\n\nThe fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures proper\nsequencing of resource cleanup and mutex operations, eliminating the\nrisk of use-after-free errors in sg_release().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-56631" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/198b89dd5a595ee3f96e5ce5c448b0484cd0e53c", "url": "https://git.kernel.org/stable/c/198b89dd5a595ee3f96e5ce5c448b0484cd0e53c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f5e2f1ca5875728fcf62bc1a054707444ab4960", "url": "https://git.kernel.org/stable/c/1f5e2f1ca5875728fcf62bc1a054707444ab4960" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/275b8347e21ab8193e93223a8394a806e4ba8918", "url": "https://git.kernel.org/stable/c/275b8347e21ab8193e93223a8394a806e4ba8918" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/285ce1f89f8d414e7eecab5ef5118cd512596318", "url": "https://git.kernel.org/stable/c/285ce1f89f8d414e7eecab5ef5118cd512596318" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59b30afa578637169e2819536bb66459fdddc39d", "url": "https://git.kernel.org/stable/c/59b30afa578637169e2819536bb66459fdddc39d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e19acb1926c4a1f30ee1ec84d8afba2d975bd534", "url": "https://git.kernel.org/stable/c/e19acb1926c4a1f30ee1ec84d8afba2d975bd534" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f10593ad9bc36921f623361c9e3dd96bd52d85ee", "url": "https://git.kernel.org/stable/c/f10593ad9bc36921f623361c9e3dd96bd52d85ee" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2024-12-27T15:02:29Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-12-27T15:02:29Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-42120", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check pipe offset before setting vblank\n\npipe_ctx has a size of MAX_PIPES so checking its index before accessing\nthe array.\n\nThis fixes an OVERRUN issue reported by Coverity.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-42120" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b3702f9d43d163fd05e43b7d7e22e766dbef329", "url": "https://git.kernel.org/stable/c/0b3702f9d43d163fd05e43b7d7e22e766dbef329" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5396a70e8cf462ec5ccf2dc8de103c79de9489e6", "url": "https://git.kernel.org/stable/c/5396a70e8cf462ec5ccf2dc8de103c79de9489e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96bf81cc1bd058bb8af6e755a548e926e934dfd1", "url": "https://git.kernel.org/stable/c/96bf81cc1bd058bb8af6e755a548e926e934dfd1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2e9abc95583ac7bbb2c47da4d476a798146dfd6", "url": "https://git.kernel.org/stable/c/b2e9abc95583ac7bbb2c47da4d476a798146dfd6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5ec2afeeee4c91cebc4eff6d4f1ecf4047259f4", "url": "https://git.kernel.org/stable/c/c5ec2afeeee4c91cebc4eff6d4f1ecf4047259f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d2c3645a4a5ae5d933b4116c305d9d82b8199dbf", "url": "https://git.kernel.org/stable/c/d2c3645a4a5ae5d933b4116c305d9d82b8199dbf" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-07-30T07:46:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-07-30T07:46:12Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39760", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: config: Prevent OOB read in SS endpoint companion parsing\n\nusb_parse_ss_endpoint_companion() checks descriptor type before length,\nenabling a potentially odd read outside of the buffer size.\n\nFix this up by checking the size first before looking at any of the\nfields in the descriptor.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39760" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/058ad2b722812708fe90567875704ae36563e33b", "url": "https://git.kernel.org/stable/c/058ad2b722812708fe90567875704ae36563e33b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4fe6f472f0beef4281e6f03bc38a910a33be663f", "url": "https://git.kernel.org/stable/c/4fe6f472f0beef4281e6f03bc38a910a33be663f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5badd56c711e2c8371d1670f9bd486697575423c", "url": "https://git.kernel.org/stable/c/5badd56c711e2c8371d1670f9bd486697575423c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5c3097ede7835d3caf6543eb70ff689af4550cd2", "url": "https://git.kernel.org/stable/c/5c3097ede7835d3caf6543eb70ff689af4550cd2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9512510cee7d1becdb0e9413fdd3ab783e4e30ee", "url": "https://git.kernel.org/stable/c/9512510cee7d1becdb0e9413fdd3ab783e4e30ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9843bcb187cb933861f7805022e6873905f669e4", "url": "https://git.kernel.org/stable/c/9843bcb187cb933861f7805022e6873905f669e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b10e0f868067c6f25bbfabdcf3e1e6432c24ca55", "url": "https://git.kernel.org/stable/c/b10e0f868067c6f25bbfabdcf3e1e6432c24ca55" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf16f408364efd8a68f39011a3b073c83a03612d", "url": "https://git.kernel.org/stable/c/cf16f408364efd8a68f39011a3b073c83a03612d" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-11T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-11T17:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46191", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46191" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0", "url": "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd", "url": "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80", "url": "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f", "url": "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27", "url": "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263", "url": "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d", "url": "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842", "url": "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-28T10:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38679", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: Fix OOB read due to missing payload bound check\n\nCurrently, The event_seq_changed() handler processes a variable number\nof properties sent by the firmware. The number of properties is indicated\nby the firmware and used to iterate over the payload. However, the\npayload size is not being validated against the actual message length.\n\nThis can lead to out-of-bounds memory access if the firmware provides a\nproperty count that exceeds the data available in the payload. Such a\ncondition can result in kernel crashes or potential information leaks if\nmemory beyond the buffer is accessed.\n\nFix this by properly validating the remaining size of the payload before\neach property access and updating bounds accordingly as properties are\nparsed.\n\nThis ensures that property parsing is safely bounded within the received\nmessage buffer and protects against malformed or malicious firmware\nbehavior.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38679" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/06d6770ff0d8cc8dfd392329a8cc03e2a83e7289", "url": "https://git.kernel.org/stable/c/06d6770ff0d8cc8dfd392329a8cc03e2a83e7289" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f08bfb5805637419902f3d70069fe17a404545b", "url": "https://git.kernel.org/stable/c/6f08bfb5805637419902f3d70069fe17a404545b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f274e2b05fdae7a53cee83979202b5ecb49035c", "url": "https://git.kernel.org/stable/c/8f274e2b05fdae7a53cee83979202b5ecb49035c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3eef5847603cd8a4110587907988c3f93c9605a", "url": "https://git.kernel.org/stable/c/a3eef5847603cd8a4110587907988c3f93c9605a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bed4921055dd7bb4d2eea2729852ae18cf97a2c6", "url": "https://git.kernel.org/stable/c/bed4921055dd7bb4d2eea2729852ae18cf97a2c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c956c3758510b448b3d4d10d1da8230e8c9bf668", "url": "https://git.kernel.org/stable/c/c956c3758510b448b3d4d10d1da8230e8c9bf668" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-09-04T15:32:35Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-04T15:32:35Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38024", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug\n\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcf/0x610 mm/kasan/report.c:489\n kasan_report+0xb5/0xe0 mm/kasan/report.c:602\n rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195\n rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132\n __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232\n rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109\n create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052\n ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095\n ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679\n vfs_write fs/read_write.c:677 [inline]\n vfs_write+0x26a/0xcc0 fs/read_write.c:659\n ksys_write+0x1b8/0x200 fs/read_write.c:731\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nIn the function rxe_create_cq, when rxe_cq_from_init fails, the function\nrxe_cleanup will be called to handle the allocated resources. In fact,\nsome memory resources have already been freed in the function\nrxe_cq_from_init. Thus, this problem will occur.\n\nThe solution is to let rxe_cleanup do all the work.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38024" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/16c45ced0b3839d3eee72a86bb172bef6cf58980", "url": "https://git.kernel.org/stable/c/16c45ced0b3839d3eee72a86bb172bef6cf58980" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/336edd6b0f5b7fbffc3e065285610624f59e88df", "url": "https://git.kernel.org/stable/c/336edd6b0f5b7fbffc3e065285610624f59e88df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a3b73e135e3bd18423d0baa72571319c7feb759", "url": "https://git.kernel.org/stable/c/3a3b73e135e3bd18423d0baa72571319c7feb759" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/52daccfc3fa68ee1902d52124921453d7a335591", "url": "https://git.kernel.org/stable/c/52daccfc3fa68ee1902d52124921453d7a335591" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c7c80c32e00665234e373ab03fe82f5c5c2c230", "url": "https://git.kernel.org/stable/c/7c7c80c32e00665234e373ab03fe82f5c5c2c230" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee4c5a2a38596d548566560c0c022ab797e6f71a", "url": "https://git.kernel.org/stable/c/ee4c5a2a38596d548566560c0c022ab797e6f71a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f81b33582f9339d2dc17c69b92040d3650bb4bae", "url": "https://git.kernel.org/stable/c/f81b33582f9339d2dc17c69b92040d3650bb4bae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f8f470e3a757425a8f98fb9a5991e3cf62fc7134", "url": "https://git.kernel.org/stable/c/f8f470e3a757425a8f98fb9a5991e3cf62fc7134" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "release_date": "2025-06-18T09:28:30Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-18T09:28:30Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-46859", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-46859" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a", "url": "https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16", "url": "https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4", "url": "https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef", "url": "https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4", "url": "https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-09-27T12:42:49Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-09-27T12:42:49Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46254", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nAppArmor: Allow apparmor to handle unaligned dfa tables\n\nThe dfa tables can originate from kernel or userspace and 8-byte alignment\nisn't always guaranteed and as such may trigger unaligned memory accesses\non various architectures. Resulting in the following\n\n[   73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720\n[   74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom\nsd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common\n[   74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE\n[   74.536543] Call Trace:\n[   74.568561] [<0000000000434c24>] dump_stack+0x8/0x18\n[   74.633757] [<0000000000476438>] __warn+0xd8/0x100\n[   74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74\n[   74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720\n[   74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0\n[   74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300\n[   74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0\n[   75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160\n[   75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280\n[   75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100\n[   75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420\n[   75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0\n[   75.406932] [<0000000000767174>] sys_write+0x14/0x40\n[   75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44\n[   75.548802] ---[ end trace 0000000000000000 ]---\n[   75.609503] dfa blob stream 0xfff0000008926b96 not aligned.\n[   75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720\n\nWork around it by using the get_unaligned_xx() helpers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46254" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23f112bd6144e815153462e12d313ac3e7027168", "url": "https://git.kernel.org/stable/c/23f112bd6144e815153462e12d313ac3e7027168" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0", "url": "https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cded636008bde2b397a7cf63b8299d7c303aaf6a", "url": "https://git.kernel.org/stable/c/cded636008bde2b397a7cf63b8299d7c303aaf6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec737e7fdf2f0ba7b203d4ec72cc915978b10e7e", "url": "https://git.kernel.org/stable/c/ec737e7fdf2f0ba7b203d4ec72cc915978b10e7e" } ], "release_date": "2026-06-03T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-03T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-43370", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix use-after-free race in VM acquire\n\nReplace non-atomic vm->process_info assignment with cmpxchg()\nto prevent race when parent/child processes sharing a drm_file\nboth try to acquire the same VM after fork().\n\n(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43370" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f", "url": "https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447", "url": "https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4", "url": "https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249", "url": "https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786", "url": "https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447", "url": "https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4", "url": "https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e61e355cbe49e585097eee28c15b862bfb1c0668", "url": "https://git.kernel.org/stable/c/e61e355cbe49e585097eee28c15b862bfb1c0668" } ], "release_date": "2026-05-08T14:21:21Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-05-08T14:21:21Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23209", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix error recovery in macvlan_common_newlink()\n\nvalis provided a nice repro to crash the kernel:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\n\nip link add mv0 link p2 type macvlan mode source\nip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20\n\nping -c1 -I p1 1.2.3.4\n\nHe also gave a very detailed analysis:\n\n\n\nThe issue is triggered when a new macvlan link is created with\nMACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or\nMACVLAN_MACADDR_SET) parameter, lower device already has a macvlan\nport and register_netdevice() called from macvlan_common_newlink()\nfails (e.g. because of the invalid link name).\n\nIn this case macvlan_hash_add_source is called from\nmacvlan_change_sources() / macvlan_common_newlink():\n\nThis adds a reference to vlan to the port's vlan_source_hash using\nmacvlan_source_entry.\n\nvlan is a pointer to the priv data of the link that is being created.\n\nWhen register_netdevice() fails, the error is returned from\nmacvlan_newlink() to rtnl_newlink_create():\n\n if (ops->newlink)\n err = ops->newlink(dev, ¶ms, extack);\n else\n err = register_netdevice(dev);\n if (err < 0) {\n free_netdev(dev);\n goto out;\n }\n\nand free_netdev() is called, causing a kvfree() on the struct\nnet_device that is still referenced in the source entry attached to\nthe lower device's macvlan port.\n\nNow all packets sent on the macvlan port with a matching source mac\naddress will trigger a use-after-free in macvlan_forward_source().\n\n\n\nWith all that, my fix is to make sure we call macvlan_flush_sources()\nregardless of @create value whenever \"goto destroy_macvlan_port;\"\npath is taken.\n\nMany thanks to valis for following up on this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23209" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11ba9f0dc865136174cb98834280fb21bbc950c7", "url": "https://git.kernel.org/stable/c/11ba9f0dc865136174cb98834280fb21bbc950c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5dae6b36a7cb7a4fcf4121b95e9ca7f96f816c8a", "url": "https://git.kernel.org/stable/c/5dae6b36a7cb7a4fcf4121b95e9ca7f96f816c8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/986967a162142710076782d5b93daab93a892980", "url": "https://git.kernel.org/stable/c/986967a162142710076782d5b93daab93a892980" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c43d0e787cbba569ec9d11579ed370b50fab6c9c", "url": "https://git.kernel.org/stable/c/c43d0e787cbba569ec9d11579ed370b50fab6c9c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cdedcd5aa3f3cb8b7ae0f87ab3a936d0bd583d66", "url": "https://git.kernel.org/stable/c/cdedcd5aa3f3cb8b7ae0f87ab3a936d0bd583d66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da5c6b8ae47e414be47e5e04def15b25d5c962dc", "url": "https://git.kernel.org/stable/c/da5c6b8ae47e414be47e5e04def15b25d5c962dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f8db6475a83649689c087a8f52486fcc53e627e9", "url": "https://git.kernel.org/stable/c/f8db6475a83649689c087a8f52486fcc53e627e9" } ], "release_date": "2026-02-14T16:27:31Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-14T16:27:31Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50406", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: iomap: fix memory corruption when recording errors during writeback\n\nEvery now and then I see this crash on arm64:\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000f8\nBuffer I/O error on dev dm-0, logical block 8733687, async page read\nMem abort info:\n ESR = 0x0000000096000006\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x06: level 2 translation fault\nData abort info:\n ISV = 0, ISS = 0x00000006\n CM = 0, WnR = 0\nuser pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000\n[00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000\nInternal error: Oops: 96000006 [#1] PREEMPT SMP\nBuffer I/O error on dev dm-0, logical block 8733688, async page read\nDumping ftrace buffer:\nBuffer I/O error on dev dm-0, logical block 8733689, async page read\n (ftrace buffer empty)\nXFS (dm-0): log I/O error -5\nModules linked in: dm_thin_pool dm_persistent_data\nXFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296).\n dm_bio_prison\nXFS (dm-0): Please unmount the filesystem and rectify the problem(s)\nXFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0\n dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT\npotentially unexpected fatal signal 6.\n nf_reject_ipv6\npotentially unexpected fatal signal 6.\n ipt_REJECT nf_reject_ipv4\nCPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7\n rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables\nHardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021\npstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)\n ip_tables\npc : 000003fd6d7df200\n x_tables\nlr : 000003fd6d7df1ec\n overlay nfsv4\nCPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405\nHardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021\nWorkqueue: writeback wb_workfn\nsp : 000003ffd9522fd0\n (flush-253:0)\npstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--)\npc : errseq_set+0x1c/0x100\nx29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780\nx26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000\nx23: 00000000ffffffff x22: 0000000000000005\nlr : __filemap_set_wb_err+0x24/0xe0\n x21: 0000000000000006\nsp : fffffe000f80f760\nx29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8\nx26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868\nx23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000\nx20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000\n\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000\nx11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288\nx8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000\nx5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8\nx20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001\nx17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668\nx2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8\nCall trace:\n errseq_set+0x1c/0x100\n __filemap_set_wb_err+0x24/0xe0\n iomap_do_writepage+0x5e4/0xd5c\n write_cache_pages+0x208/0x674\n iomap_writepages+0x34/0x60\n xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b]\nx14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180\nx11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288\nx8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee\nx5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020\nx2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000\nCPU: \n---truncated---", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50406" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d5f3ba1ac28059bdf7000cae2403e4e984308d2", "url": "https://git.kernel.org/stable/c/3d5f3ba1ac28059bdf7000cae2403e4e984308d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7308591d9c7787aec58f6a01a7823f14e90db7a2", "url": "https://git.kernel.org/stable/c/7308591d9c7787aec58f6a01a7823f14e90db7a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82c66c46f73b88be74c869e2cbfef45281adf3c6", "url": "https://git.kernel.org/stable/c/82c66c46f73b88be74c869e2cbfef45281adf3c6" } ], "release_date": "2025-09-18T16:03:51Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-09-18T16:03:51Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-23156", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: refactor hfi packet parsing logic\n\nwords_count denotes the number of words in total payload, while data\npoints to payload of various property within it. When words_count\nreaches last word, data can access memory beyond the total payload. This\ncan lead to OOB access. With this patch, the utility api for handling\nindividual properties now returns the size of data consumed. Accordingly\nremaining bytes are calculated before parsing the payload, thereby\neliminates the OOB access possibilities.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-23156" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05b07e52a0d08239147ba3460045855f4fb398de", "url": "https://git.kernel.org/stable/c/05b07e52a0d08239147ba3460045855f4fb398de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0beabe9b49190a02321b02792b29fc0f0e28b51f", "url": "https://git.kernel.org/stable/c/0beabe9b49190a02321b02792b29fc0f0e28b51f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f9a4bab7d83738963365372e4745854938eab2d", "url": "https://git.kernel.org/stable/c/0f9a4bab7d83738963365372e4745854938eab2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6d278c5548d840c4d85d445347b2a5c31b2ab3a0", "url": "https://git.kernel.org/stable/c/6d278c5548d840c4d85d445347b2a5c31b2ab3a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9edaaa8e3e15aab1ca413ab50556de1975bcb329", "url": "https://git.kernel.org/stable/c/9edaaa8e3e15aab1ca413ab50556de1975bcb329" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01", "url": "https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb3fd8b7906a12dc2b61389abb742bf6542d97fb", "url": "https://git.kernel.org/stable/c/bb3fd8b7906a12dc2b61389abb742bf6542d97fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f195e94c7af921d99abd79f57026a218d191d2c7", "url": "https://git.kernel.org/stable/c/f195e94c7af921d99abd79f57026a218d191d2c7" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-01T12:55:42Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-01T12:55:42Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-40929", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\n\nIn some versions of cfg80211, the ssids poinet might be a valid one even\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\nout-of-bound access. Fix this by checking n_ssids first.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-40929" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a", "url": "https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b", "url": "https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281", "url": "https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b", "url": "https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614", "url": "https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640", "url": "https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "release_date": "2024-07-12T12:25:08Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-07-12T12:25:08Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47479", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix use-after-free in rtl8712_dl_fw\n\nSyzbot reported use-after-free in rtl8712_dl_fw(). The problem was in\nrace condition between r871xu_dev_remove() ->ndo_open() callback.\n\nIt's easy to see from crash log, that driver accesses released firmware\nin ->ndo_open() callback. It may happen, since driver was releasing\nfirmware _before_ unregistering netdev. Fix it by moving\nunregister_netdev() before cleaning up resources.\n\nCall Trace:\n...\n rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]\n rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170\n rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]\n rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394\n netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380\n __dev_open+0x2bc/0x4d0 net/core/dev.c:1484\n\nFreed by task 1306:\n...\n release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053\n r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599\n usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47479" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a65c9afe9f2f55b7a7fb4a25ab654cd4139683a4", "url": "https://git.kernel.org/stable/c/a65c9afe9f2f55b7a7fb4a25ab654cd4139683a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/befd23bd3b17f1a3f9c943a8580b47444c7c63ed", "url": "https://git.kernel.org/stable/c/befd23bd3b17f1a3f9c943a8580b47444c7c63ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c052cc1a069c3e575619cf64ec427eb41176ca70", "url": "https://git.kernel.org/stable/c/c052cc1a069c3e575619cf64ec427eb41176ca70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c430094541a80575259a94ff879063ef01473506", "url": "https://git.kernel.org/stable/c/c430094541a80575259a94ff879063ef01473506" } ], "release_date": "2024-05-22T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-05-22T09:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53186", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp->data + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc->byte_len; this brings ib_srp into line with them.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53186" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293", "url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1", "url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4", "url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce", "url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7", "url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde", "url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb", "url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57", "url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57" } ], "release_date": "2026-06-25T08:38:59Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-25T08:38:59Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23448", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len)\n\nbut the second check omits it:\n\n if ((sizeof(struct usb_cdc_ncm_ndp16) +\n ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23448" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a", "url": "https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b", "url": "https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80", "url": "https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611", "url": "https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3", "url": "https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3" } ], "release_date": "2026-04-03T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-03T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-47049", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Use after free in __vmbus_open()\n\nThe \"open_info\" variable is added to the &vmbus_connection.chn_msg_list,\nbut the error handling frees \"open_info\" without removing it from the\nlist. This will result in a use after free. First remove it from the\nlist, and then free it.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2728f289b3270b0e273292b46c534421a33bbfd5", "url": "https://git.kernel.org/stable/c/2728f289b3270b0e273292b46c534421a33bbfd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e9bf43f7f7a46f21ec071cb47be92d0874c48da", "url": "https://git.kernel.org/stable/c/3e9bf43f7f7a46f21ec071cb47be92d0874c48da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d5c7b42c9f56ca46b286daa537d181bd7f69214f", "url": "https://git.kernel.org/stable/c/d5c7b42c9f56ca46b286daa537d181bd7f69214f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f37dd5d1b5d38a79a4f7b8dd7bbb705505f05560", "url": "https://git.kernel.org/stable/c/f37dd5d1b5d38a79a4f7b8dd7bbb705505f05560" } ], "release_date": "2024-02-28T08:13:52Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2024-02-28T08:13:52Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-52919", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix tp_meter counter underflow during shutdown\n\nbatadv_tp_sender_shutdown() unconditionally decrements the \"sending\"\natomic counter. If multiple paths (e.g. timeout, user cancel, and\nnormal finish) call this function, the counter can underflow to -1.\n\nSince the sender logic treats any non-zero value as \"still sending\",\na negative value causes the sender kthread to loop indefinitely.\nThis leads to a use-after-free when the interface is removed while\nthe zombie thread is still active.\n\nFix this by using atomic_xchg() to ensure the counter only transitions\nfrom 1 to 0 once.\n\n[sven: added missing change in batadv_tp_send]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52919" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01cefc5923889e29dbb5f281c3d457714ceb9c00", "url": "https://git.kernel.org/stable/c/01cefc5923889e29dbb5f281c3d457714ceb9c00" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90ae3eae06b7b8ab9f6250b9497c860915b4c17b", "url": "https://git.kernel.org/stable/c/90ae3eae06b7b8ab9f6250b9497c860915b4c17b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94f3b133168d1c49895e7cc6afbcf1cc0b354602", "url": "https://git.kernel.org/stable/c/94f3b133168d1c49895e7cc6afbcf1cc0b354602" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/abae88fa254f2981d39ac003a7b302528a22af64", "url": "https://git.kernel.org/stable/c/abae88fa254f2981d39ac003a7b302528a22af64" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aeae11c5dad9cd0d50723890bdd866f8e6db2e7d", "url": "https://git.kernel.org/stable/c/aeae11c5dad9cd0d50723890bdd866f8e6db2e7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1bac194733aabd731aafa6a01350c229e187dba", "url": "https://git.kernel.org/stable/c/c1bac194733aabd731aafa6a01350c229e187dba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c66d20a3ff095e3f000551d208ec2606616db15c", "url": "https://git.kernel.org/stable/c/c66d20a3ff095e3f000551d208ec2606616db15c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e75e2ab463b5b34df6b98f94d740aff327ce9f6b", "url": "https://git.kernel.org/stable/c/e75e2ab463b5b34df6b98f94d740aff327ce9f6b" } ], "release_date": "2026-06-24T07:14:15Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-06-24T07:14:15Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-22083", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint\n\nIf vhost_scsi_set_endpoint is called multiple times without a\nvhost_scsi_clear_endpoint between them, we can hit multiple bugs\nfound by Haoran Zhang:\n\n1. Use-after-free when no tpgs are found:\n\nThis fixes a use after free that occurs when vhost_scsi_set_endpoint is\ncalled more than once and calls after the first call do not find any\ntpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds\ntpgs to add to the vs_tpg array match=true, so we will do:\n\nvhost_vq_set_backend(vq, vs_tpg);\n...\n\nkfree(vs->vs_tpg);\nvs->vs_tpg = vs_tpg;\n\nIf vhost_scsi_set_endpoint is called again and no tpgs are found\nmatch=false so we skip the vhost_vq_set_backend call leaving the\npointer to the vs_tpg we then free via:\n\nkfree(vs->vs_tpg);\nvs->vs_tpg = vs_tpg;\n\nIf a scsi request is then sent we do:\n\nvhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend\n\nwhich sees the vs_tpg we just did a kfree on.\n\n2. Tpg dir removal hang:\n\nThis patch fixes an issue where we cannot remove a LIO/target layer\ntpg (and structs above it like the target) dir due to the refcount\ndropping to -1.\n\nThe problem is that if vhost_scsi_set_endpoint detects a tpg is already\nin the vs->vs_tpg array or if the tpg has been removed so\ntarget_depend_item fails, the undepend goto handler will do\ntarget_undepend_item on all tpgs in the vs_tpg array dropping their\nrefcount to 0. At this time vs_tpg contains both the tpgs we have added\nin the current vhost_scsi_set_endpoint call as well as tpgs we added in\nprevious calls which are also in vs->vs_tpg.\n\nLater, when vhost_scsi_clear_endpoint runs it will do\ntarget_undepend_item on all the tpgs in the vs->vs_tpg which will drop\ntheir refcount to -1. Userspace will then not be able to remove the tpg\nand will hang when it tries to do rmdir on the tpg dir.\n\n3. Tpg leak:\n\nThis fixes a bug where we can leak tpgs and cause them to be\nun-removable because the target name is overwritten when\nvhost_scsi_set_endpoint is called multiple times but with different\ntarget names.\n\nThe bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup\na vhost-scsi device to target/tpg mapping, then calls\nVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we\nhaven't seen before (target1 has tpg1 but target2 has tpg2). When this\nhappens we don't teardown the old target tpg mapping and just overwrite\nthe target name and the vs->vs_tpg array. Later when we do\nvhost_scsi_clear_endpoint, we are passed in either target1 or target2's\nname and we will only match that target's tpgs when we loop over the\nvs->vs_tpg. We will then return from the function without doing\ntarget_undepend_item on the tpgs.\n\nBecause of all these bugs, it looks like being able to call\nvhost_scsi_set_endpoint multiple times was never supported. The major\nuser, QEMU, already has checks to prevent this use case. So to fix the\nissues, this patch prevents vhost_scsi_set_endpoint from being called\nif it's already successfully added tpgs. To add, remove or change the\ntpg config or target name, you must do a vhost_scsi_clear_endpoint\nfirst.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22083" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a", "url": "https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92", "url": "https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e", "url": "https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/451c72f5e7cf5d339a6410a635cee0825687c3dc", "url": "https://git.kernel.org/stable/c/451c72f5e7cf5d339a6410a635cee0825687c3dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6", "url": "https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c", "url": "https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ], "release_date": "2025-04-16T14:12:32Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-04-16T14:12:32Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-39891", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Initialize the chan_stats array to zero\n\nThe adapter->chan_stats[] array is initialized in\nmwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out\nmemory. The array is filled in mwifiex_update_chan_statistics()\nand then the user can query the data in mwifiex_cfg80211_dump_survey().\n\nThere are two potential issues here. What if the user calls\nmwifiex_cfg80211_dump_survey() before the data has been filled in.\nAlso the mwifiex_update_chan_statistics() function doesn't necessarily\ninitialize the whole array. Since the array was not initialized at\nthe start that could result in an information leak.\n\nAlso this array is pretty small. It's a maximum of 900 bytes so it's\nmore appropriate to use kcalloc() instead vmalloc().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-39891" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05daef0442d28350a1a0d6d0e2cab4a7a91df475", "url": "https://git.kernel.org/stable/c/05daef0442d28350a1a0d6d0e2cab4a7a91df475" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/06616410a3e5e6cd1de5b7cbc668f1a7edeedad9", "url": "https://git.kernel.org/stable/c/06616410a3e5e6cd1de5b7cbc668f1a7edeedad9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e20450829ca3c1dbc2db536391537c57a40fe0b", "url": "https://git.kernel.org/stable/c/0e20450829ca3c1dbc2db536391537c57a40fe0b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32c124c9c03aa755cbaf60ef7f76afd918d47659", "url": "https://git.kernel.org/stable/c/32c124c9c03aa755cbaf60ef7f76afd918d47659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5285b7009dc1e09d5bb9e05fae82e1a807882dbc", "url": "https://git.kernel.org/stable/c/5285b7009dc1e09d5bb9e05fae82e1a807882dbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9df29aa5637d94d24f7c5f054ef4feaa7b766111", "url": "https://git.kernel.org/stable/c/9df29aa5637d94d24f7c5f054ef4feaa7b766111" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65", "url": "https://git.kernel.org/stable/c/9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/acdf26a912190fc6746e2a890d7d0338190527b4", "url": "https://git.kernel.org/stable/c/acdf26a912190fc6746e2a890d7d0338190527b4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-10-01T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-10-01T08:15:00Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-23157", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-23157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/172bf5a9ef70a399bb227809db78442dc01d9e48", "url": "https://git.kernel.org/stable/c/172bf5a9ef70a399bb227809db78442dc01d9e48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ad6aa1464b8a5ce5c194458315021e8d216108e", "url": "https://git.kernel.org/stable/c/1ad6aa1464b8a5ce5c194458315021e8d216108e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26bbedd06d85770581fda5d78e78539bb088fad1", "url": "https://git.kernel.org/stable/c/26bbedd06d85770581fda5d78e78539bb088fad1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b8b9ea4e26a501eb220ea189e42b4527e65bdfa", "url": "https://git.kernel.org/stable/c/2b8b9ea4e26a501eb220ea189e42b4527e65bdfa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53e376178ceacca3ef1795038b22fc9ef45ff1d3", "url": "https://git.kernel.org/stable/c/53e376178ceacca3ef1795038b22fc9ef45ff1d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2541e29d82da8a0df728aadec3e0a8db55d517b", "url": "https://git.kernel.org/stable/c/b2541e29d82da8a0df728aadec3e0a8db55d517b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb5be9039f91979f8a2fac29f529f746d7848f3e", "url": "https://git.kernel.org/stable/c/cb5be9039f91979f8a2fac29f529f746d7848f3e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4d88ece4ba91df5b02f1d3f599650f9e9fc0f45", "url": "https://git.kernel.org/stable/c/d4d88ece4ba91df5b02f1d3f599650f9e9fc0f45" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5133a0b25463674903fdc0528e0a29b7267130e", "url": "https://git.kernel.org/stable/c/e5133a0b25463674903fdc0528e0a29b7267130e" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "release_date": "2025-05-01T12:55:43Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-01T12:55:43Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38212", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: fix to protect IPCS lookups using RCU\n\nsyzbot reported that it discovered a use-after-free vulnerability, [0]\n\n[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/\n\nidr_for_each() is protected by rwsem, but this is not enough. If it is\nnot protected by RCU read-critical region, when idr_for_each() calls\nradix_tree_node_free() through call_rcu() to free the radix_tree_node\nstructure, the node will be freed immediately, and when reading the next\nnode in radix_tree_for_each_slot(), the already freed memory may be read.\n\nTherefore, we need to add code to make sure that idr_for_each() is\nprotected within the RCU read-critical region when we call it in\nshm_destroy_orphaned().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38212" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5180561afff8e0f029073c8c8117c95c6512d1f9", "url": "https://git.kernel.org/stable/c/5180561afff8e0f029073c8c8117c95c6512d1f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f1e1573bf103303944fd7225559de5d8297539c", "url": "https://git.kernel.org/stable/c/5f1e1573bf103303944fd7225559de5d8297539c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68c173ea138b66d7dd1fd980c9bc578a18e11884", "url": "https://git.kernel.org/stable/c/68c173ea138b66d7dd1fd980c9bc578a18e11884" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74bc813d11c30e28fc5261dc877cca662ccfac68", "url": "https://git.kernel.org/stable/c/74bc813d11c30e28fc5261dc877cca662ccfac68" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78297d53d3878d43c1d627d20cd09f611fa4b91d", "url": "https://git.kernel.org/stable/c/78297d53d3878d43c1d627d20cd09f611fa4b91d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0b6bf90ce2699a574b3683e22c44d0dcdd7a057", "url": "https://git.kernel.org/stable/c/b0b6bf90ce2699a574b3683e22c44d0dcdd7a057" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b968ba8bfd9f90914957bbbd815413bf6a98eca7", "url": "https://git.kernel.org/stable/c/b968ba8bfd9f90914957bbbd815413bf6a98eca7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d66adabe91803ef34a8b90613c81267b5ded1472", "url": "https://git.kernel.org/stable/c/d66adabe91803ef34a8b90613c81267b5ded1472" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2025-07-04T13:37:30Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-07-04T13:37:30Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-38000", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38000" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a", "url": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335", "url": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d", "url": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf", "url": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653", "url": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02", "url": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4", "url": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228", "url": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-06-06T13:03:35Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-06-06T13:03:35Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53111", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Fix use-after-free issues\n\ndo_req_filebacked() calls blk_mq_complete_request() synchronously or\nasynchronously when using asynchronous I/O unless memory allocation fails.\nHence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor\n'rq' after do_req_filebacked() finished unless we are sure that the request\nhas not yet been completed. This patch fixes the following kernel crash:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000054\nCall trace:\n css_put.42938+0x1c/0x1ac\n loop_process_work+0xc8c/0xfd4\n loop_rootcg_workfn+0x24/0x34\n process_one_work+0x244/0x558\n worker_thread+0x400/0x8fc\n kthread+0x16c/0x1e0\n ret_from_fork+0x10/0x20", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53111" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/407badf73ec9fb0d5744bf2ca1745c1818aa222f", "url": "https://git.kernel.org/stable/c/407badf73ec9fb0d5744bf2ca1745c1818aa222f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6917395c4667cfb607ed8bf1826205a59414657c", "url": "https://git.kernel.org/stable/c/6917395c4667cfb607ed8bf1826205a59414657c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b0cb770f5d7b1ff40bea7ca385438ee94570eec", "url": "https://git.kernel.org/stable/c/9b0cb770f5d7b1ff40bea7ca385438ee94570eec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3fda704903f6d1fc351412f1bc6620333959ada", "url": "https://git.kernel.org/stable/c/e3fda704903f6d1fc351412f1bc6620333959ada" } ], "release_date": "2025-05-02T15:55:51Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2025-05-02T15:55:51Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-23193", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess->session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23193" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca", "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d", "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7", "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4", "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a", "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9", "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb", "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb" } ], "release_date": "2026-02-14T16:27:20Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-02-14T16:27:20Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-31629", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: add missing return after LLCP_CLOSED checks\n\nIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket\nstate is LLCP_CLOSED, the code correctly calls release_sock() and\nnfc_llcp_sock_put() but fails to return. Execution falls through to\nthe remainder of the function, which calls release_sock() and\nnfc_llcp_sock_put() again. This results in a double release_sock()\nand a refcount underflow via double nfc_llcp_sock_put(), leading to\na use-after-free.\n\nAdd the missing return statements after the LLCP_CLOSED branches\nin both functions to prevent the fall-through.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "known_affected": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-31629" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf", "url": "https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c", "url": "https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26", "url": "https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2", "url": "https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf", "url": "https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6", "url": "https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6", "url": "https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f", "url": "https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9", "url": "https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9" } ], "release_date": "2026-04-24T14:42:49Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-03T15:35:30.358341Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-29-all-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-all-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-amd64-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-29-common-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-29-amd64-unsigned-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-2+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-2+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-29-0:4.19.325-2+tuxcare.els1.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788449727" }, { "category": "none_available", "date": "2026-04-24T14:42:49Z", "details": "Affected", "product_ids": [ "Debian-10:hyperv-daemons-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libbpf4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:libcpupower1-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-compiler-gcc-8-x86-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-config-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-cpupower-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-doc-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-headers-4.19.0-28-all-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-all-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-amd64-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-headers-4.19.0-28-common-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-image-4.19.0-28-amd64-unsigned-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-image-amd64-signed-template-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-kbuild-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-libc-dev-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-perf-4.19-0:4.19.325-1+tuxcare.els1.amd64", "Debian-10:linux-source-4.19-0:4.19.325-1+tuxcare.els1.all", "Debian-10:linux-support-4.19.0-28-0:4.19.325-1+tuxcare.els1.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }