https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 03:56:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-64544 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents</p> <p>pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages.</p> <p>BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: &lt;TASK&gt; __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) &lt;/TASK&gt; Kernel panic - not syncing: Fatal exception</p> <p>Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents</p> <p>pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages.</p> <p>BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: &lt;TASK&gt; __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) &lt;/TASK&gt; Kernel panic - not syncing: Fatal exception</p> <p>Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.</p> https://cve.radiocsirt.org/vuln/cve-2026-64544 https://cve.radiocsirt.org/vuln/usn-8875-1 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: linux-aws-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-fde-5.15, Ubuntu:Pro:20.04:LTS: linux-hwe-5.15, Ubuntu:Pro:20.04:LTS: linux-ibm-5.15, Ubuntu:Pro:20.04:LTS: linux-intel-iotg-5.15, Ubuntu:Pro:20.04:LTS: linux-lowlatency-hwe-5.15, Ubuntu:22.04:LTS: linux, Ubuntu:22.04:LTS: linux-aws, Ubuntu:22.04:LTS: linux-azure and 13 more</p> <p>It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)</p> <p>Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API (UAPI); - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - In…</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: linux-aws-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-5.15, Ubuntu:Pro:20.04:LTS: linux-azure-fde-5.15, Ubuntu:Pro:20.04:LTS: linux-hwe-5.15, Ubuntu:Pro:20.04:LTS: linux-ibm-5.15, Ubuntu:Pro:20.04:LTS: linux-intel-iotg-5.15, Ubuntu:Pro:20.04:LTS: linux-lowlatency-hwe-5.15, Ubuntu:22.04:LTS: linux, Ubuntu:22.04:LTS: linux-aws, Ubuntu:22.04:LTS: linux-azure and 13 more</p> <p>It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)</p> <p>Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API (UAPI); - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Android drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Bluetooth drivers; - Cdrom driver; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - DAX dirext access to differentiated memory framework; - DMA engine subsystem; - FireWire subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - In…</p> https://cve.radiocsirt.org/vuln/usn-8875-1