1 / 6 · Summary
Still need a fix: 258
| Build | cve-scan-05f047ad |
| BUILD_ID | 20261015T093253Z-cvescan-05f047a |
| Manifest | lib32-optisigns-image-optistick-panthor-mesons7d-bm201-6.12-lib32-20261015093317.manifest |
| Source | main-amlinux @ 05f047a · run branch cve-scan/amlinux-20261015-1632 |
| Versions | kernel 6.12.38 · U-Boot 2023.01 · browser engine not found |
| NVD data | 2026-10-15 09:25 UTC · scanned 2026-10-15 09:46 UTC |
| Data version | nvd 2026-10-15T09:25 · cna 5d7cf843 · bulletin n/a (no vendor bulletin, CNA only) · rules 822a28be |
| Vendor bulletins | no vendor bulletin: kernel fix mapping is CNA-only |
| Kernel "fixed in source" check | network-reachable CVEs only (run with --fixed-status for all) |
What to do: the ranked fix plan, with risks and rollback, is on page 6.
2 / 6 · Triage
Every CVE matched against this image lands in exactly one bucket, and the run refuses to finish if one falls through. The ruled-out CVEs split into not affected (the vulnerable code cannot run on this product) and risk accepted (the code is reachable, but a ruling judged the risk low). Exclusions come from the build itself: the shipped kernel .config, the objects the U-Boot build produced, the rootfs, and fixes already in our source.
| Bucket | CVEs | Evidence |
|---|---|---|
| Still need a fix | 258 | reachable over a network, code built in, fix not in our source, and NVD confirms our version |
| Unconfirmed: NVD gives no version | 24 | only unversioned NVD rows match; re-judged every scan, never in a fix module |
| Already fixed | 213 | SBOM patches 152 · recipe patches 54 · CVE_STATUS 4 · in source 3 |
| Ruled out — not affected | 1,418 | the vulnerable code cannot run on this product |
| Kernel: code not built | 1,376 | CONFIG off in the shipped .config, mapped through the kernel Makefiles; or another architecture |
| Kernel: no path from userspace | 2 | the subsystem is built but nothing in the rootfs can reach it |
| Kernel: other rulings | 7 | fix already in our kernel source, not our software, an NVD attribution error, code not in our kernel version, or a stored review ruling |
| U-Boot: code not in our bootloader | 1 | the fix touches code our U-Boot does not build or does not have |
| Userland: not ours / not our platform | 32 | NVD vendor-name collisions, other operating systems, other products |
| Ruled out — risk accepted by rule | 1,560 | reachable, but a standing ruling (local or physical access only) judged the risk low |
| Kernel: local access only | 1,373 | NVD attack vector LOCAL or PHYSICAL; the product has no root login |
| Userland: local access only | 187 | needs an attacker already on the device; low risk by ruling |
| Browser engine, grouped | 0 | Chromium build not found: not matched |
| CVE | Priority | CVSS | Component | Why unconfirmed |
|---|---|---|---|---|
| CVE-2026-4424 | P1 | 7.5 | libarchive 3.6.2 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.6.2 |
| CVE-2026-5201 | P1 | 7.5 | gdk-pixbuf 2.42.10 | NVD lists gdk-pixbuf with no version ("-") only: unanalysed, not confirmed for 2.42.10 |
| CVE-2026-2369 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2436 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-4426 | P2 | 6.5 | libarchive 3.6.2 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.6.2 |
| CVE-2026-66337 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-66339 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-5119 | P2 | 5.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1467 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1536 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1539 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3099 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-66338 | P2 | 5.4 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1801 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2443 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-4271 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-12549 | P2 | 4.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-12891 | P2 | 4.3 | gstreamer 1.20.7 | NVD lists gstreamer with no version ("-") only: unanalysed, not confirmed for 1.20.7 |
| CVE-2026-12548 | P2 | 4.2 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3632 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3633 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3634 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2708 | P2 | 3.7 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3184 | P2 | 3.7 | util-linux 2.37.4 | NVD lists util-linux with no version ("-") only: unanalysed, not confirmed for 2.37.4 |
gstreamer1.0-plugins-good 21, expat-native 18, unzip 14, libxml2-native 13, gstreamer1.0-plugins-bad 7, gstreamer1.0-plugins-base 7, glib-2.0-native 7, rsync-native 4, cups 4, cairo 4 · +30 more
not found: the Electron 43.0.0 runtime (meta-optisigns-poky-common/recipes-optisigns/optisigns-osui-runtime/optisigns-osui-runtime_43.0.0.bb) does not state its Chromium build, so the browser engine is not matched against NVD
3 / 6 · Kernel
Kernel 6.12.38: 110 CVEs still need a fix, by area.
31 P0 items, highest CVSS first.
| CVE | Area | What it is | CVSS |
|---|---|---|---|
| CVE-2026-63795 | NET_9P | 9p: avoid putting oldfid in p9_client_walk() error path | 10.0 |
| CVE-2025-38472 | NF_CONNTRACK | netfilter: nf_conntrack: fix crash due to removal of uninitialised | 9.8 |
| CVE-2025-39946 | TLS | tls: make sure to abort the stream if headers are bogus | 9.8 |
| CVE-2026-23240 | TLS | tls: Fix race condition in tls_sw_cancel_work_tx() | 9.8 |
| CVE-2026-31414 | NF_CONNTRACK | netfilter: nf_conntrack_expect: use expect->helper | 9.8 |
| CVE-2026-31533 | TLS | net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption | 9.8 |
| CVE-2026-43037 | IPV6_TUNNEL | ip6_tunnel: clear skb2->cb[] in ip4ip6_err() | 9.8 |
| CVE-2026-46115 | BLOCK | block: add pgmap check to biovec_phys_mergeable | 9.8 |
| CVE-2026-46289 | NETFS_SUPPORT | lib/scatterlist: fix length calculations in extract_kvec_to_sg | 9.8 |
| CVE-2026-52993 | TIPC | tipc: fix double-free in tipc_buf_append() | 9.8 |
| CVE-2026-53002 | NF_NAT_AMANDA | netfilter: conntrack: remove sprintf usage | 9.8 |
| CVE-2026-53221 | IPV6_VTI | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 |
| CVE-2026-53228 | IPV6_SIT | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 |
| CVE-2026-53384 | SERIAL_8250_DW | serial: 8250_dw: unregister 8250 port if clk_notifier_register() | 9.8 |
17 more P0 items, and every fix commit, in fixlist.html.
| CVE | Priority | CVSS | Area | What it is | Fix |
|---|---|---|---|---|---|
| Other drivers and core · 54 (P0 22 · P1 30 · P2 2) | |||||
| CVE-2026-63795 | P0 | 10.0 | NET_9P | 9p: avoid putting oldfid in p9_client_walk() error path | applies cleanlyBackport upstream commit 1a3860d46e3e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-39946 | P0 | 9.8 | TLS | tls: make sure to abort the stream if headers are bogus | applies cleanlyBackport upstream commit 0aeb54ac4cd5 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23240 | P0 | 9.8 | TLS | tls: Fix race condition in tls_sw_cancel_work_tx() | applies cleanlyBackport upstream commit 7bb09315f93d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31533 | P0 | 9.8 | TLS | net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption | applies cleanlyBackport upstream commit a9b8b18364ff (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46115 | P0 | 9.8 | BLOCK | block: add pgmap check to biovec_phys_mergeable | applies cleanlyBackport upstream commit 13920e4b7b78 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46289 | P0 | 9.8 | NETFS_SUPPORT | lib/scatterlist: fix length calculations in extract_kvec_to_sg | applies cleanlyBackport upstream commit 07b7d66e65d9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52993 | P0 | 9.8 | TIPC | tipc: fix double-free in tipc_buf_append() | applies cleanlyBackport upstream commit d293ca716e7d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53384 | P0 | 9.8 | SERIAL_8250_DW | serial: 8250_dw: unregister 8250 port if clk_notifier_register() | needs reworkBackport upstream commit 10fc708b4de7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64025 | P0 | 9.8 | NET_SOCK_MSG | bpf, skmsg: fix verdict sk_data_ready racing with ktls rx | needs reworkBackport upstream commit ddf8029623a1 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64046 | P0 | 9.8 | TLS | net: tls: prevent chain-after-chain in plain text SG | needs reworkBackport upstream commit ff26a0e8377d — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64047 | P0 | 9.8 | TLS | net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg | applies cleanlyBackport upstream commit 285943c6e7ca (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64061 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix early put of sink folio in netfs_read_gaps() | applies cleanlyBackport upstream commit 3e5dd91b87a8 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64066 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix netfs_read_to_pagecache() to pause on subreq failure | needs reworkBackport upstream commit 8a8c0cfdf465 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64067 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix missing barriers when accessing stream->subrequests | needs reworkBackport upstream commit b5782e2d462c — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64068 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix missing locking around retry adding new subreqs | needs reworkBackport upstream commit cce18c263e96 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64160 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix potential for tearing in ->remote_i_size and ->zero_point | needs reworkBackport upstream commit 2c8f4742bb76 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64216 | P0 | 9.8 | NETFS_SUPPORT | netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() | needs reworkBackport upstream commit dbe556972100 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64355 | P0 | 9.8 | BPF_SYSCALL | bpf: Reject fragmented frames in devmap | applies cleanlyBackport upstream commit aa496720618f (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31448 | P0 | 9.4 | EXT4_FS | ext4: avoid infinite loops caused by residual data | applies cleanlyBackport upstream commit 5422fe71d26d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31682 | P0 | 9.1 | BRIDGE | bridge: br_nd_send: linearize skb before parsing ND options | applies cleanlyBackport upstream commit a01aee7cafc5 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43197 | P0 | 9.1 | NETCONSOLE | netconsole: avoid OOB reads, msg is not nul-terminated | needs reworkBackport upstream commit 82aec772fca2 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64450 | P0 | 9.1 | TIPC | tipc: fix out-of-bounds read in broadcast Gap ACK blocks | applies cleanlyBackport upstream commit 2b66974a1b61 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38495 | P1 | 8.8 | HID | HID: core: ensure the allocated report buffer can contain the | applies cleanlyBackport upstream commit 4f15ee98304b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-39806 | P1 | 8.8 | HID_MULTITOUCH | HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() | applies cleanlyBackport upstream commit 0379eb8691b9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31435 | P1 | 8.8 | NETFS_SUPPORT | netfs: Fix read abandonment during retry | needs reworkBackport upstream commit 7e57523490cd — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31450 | P1 | 8.8 | EXT4_FS | ext4: publish jinode after initialization | needs reworkBackport upstream commit 1aec30021edd — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31570 | P1 | 8.8 | CAN_GW | can: gw: fix OOB heap access in cgw_csum_crc8_rel() | applies cleanlyBackport upstream commit b9c310d72783 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31629 | P1 | 8.8 | NFC | nfc: llcp: add missing return after LLCP_CLOSED checks | applies cleanlyBackport upstream commit 2b5dd4632966 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43048 | P1 | 8.8 | HID | HID: core: Mitigate potential OOB by removing bogus memset() | applies cleanlyBackport upstream commit 0a3fe972a7cb (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63801 | P1 | 8.8 | TIPC_CRYPTO | tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done | applies cleanlyBackport upstream commit bda3348872a2 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64010 | P1 | 8.8 | NFC | nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() | applies cleanlyBackport upstream commit b493ea2765cc (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64313 | P1 | 8.8 | CRYPTO_ECC | crypto: ecc - Fix carry overflow in vli multiplication | applies cleanlyBackport upstream commit 27b536a2ec8e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38574 | P1 | 8.6 | PPTP | pptp: ensure minimal skb length in pptp_xmit() | applies cleanlyBackport upstream commit de9c4861fb42 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38608 | P1 | 8.6 | TLS | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | applies cleanlyBackport upstream commit 178f6a5c8cb3 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-68365 | P1 | 8.2 | NTFS3_FS | fs/ntfs3: Initialize allocated memory before use | needs reworkBackport upstream commit a8a3ca23bbd9 — needs rework (context drifted) -> stage the patch… |
| CVE-2025-71311 | P1 | 8.2 | NTFS3_FS | fs/ntfs3: Initialize new folios before use | applies cleanlyBackport upstream commit f223ebffa185 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64435 | P1 | 8.2 | AUDIT | audit: Fix data races of skb_queue_len() readers on audit_queue | applies cleanlyBackport upstream commit c9a71daaecb2 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43051 | P1 | 8.1 | HID_WACOM | HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq | applies cleanlyBackport upstream commit 2f1763f62909 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46232 | P1 | 8.1 | HID_PLAYSTATION | HID: playstation: Clamp num_touch_reports | applies cleanlyBackport upstream commit cac61b58a3b6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71131 | P1 | 7.5 | CRYPTO_SEQIV | crypto: seqiv - Do not use req->iv after crypto_aead_encrypt | applies cleanlyBackport upstream commit 50fdb78b7c0b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71161 | P1 | 7.5 | DM_VERITY | dm-verity: disable recursive forward error correction | needs reworkBackport upstream commit d9f3e47d3fae — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31467 | P1 | 7.5 | EROFS_FS_ZIP | erofs: add GFP_NOIO in the bio completion if needed | applies cleanlyBackport upstream commit c23df30915f8 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31662 | P1 | 7.5 | TIPC | tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG | applies cleanlyBackport upstream commit 48a5fe38772b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43245 | P1 | 7.5 | NTFS3_FS | ntfs: ->d_compare() must not block | needs reworkBackport upstream commit ca2a04e84af7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43336 | P1 | 7.5 | CRYPTO | lib/crypto: chacha: Zeroize permuted_state before it leaves scope | needs reworkBackport upstream commit e5046823f8fa — needs rework (context drifted) -> stage the patch… |
| CVE-2026-46102 | P1 | 7.5 | STREAM_PARSER | net: strparser: fix skb_head leak in strp_abort_strp() | applies cleanlyBackport upstream commit fe72340daaf1 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52946 | P1 | 7.5 | IO_URING | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling | applies cleanlyBackport upstream commit 00633c468382 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52974 | P1 | 7.5 | TLS | net: tls: fix strparser anchor skb leak on offload RX setup failure | applies cleanlyBackport upstream commit 58689498ca33 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64003 | P1 | 7.5 | SCSI | scsi: core: Run queues for all non-SDEV_DEL devices from | applies cleanlyBackport upstream commit 7205b5870227 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-39723 | P1 | 7.1 | NETFS_SUPPORT | netfs: Fix unbuffered write error handling | needs reworkBackport upstream commit a3de58b12ce0 — needs rework (context drifted) -> stage the patch… |
| CVE-2025-71289 | P1 | 7.1 | NTFS3_FS | fs/ntfs3: handle attr_set_size() errors when truncating files | needs reworkBackport upstream commit 576248a34b92 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64452 | P1 | 7.1 | 6LOWPAN | 6lowpan: fix NHC entry use-after-free on error path | applies cleanlyBackport upstream commit 1720db928e5a (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2022-3523 | P2 | 5.3 | MMU | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3629 | P2 | 3.3 | VSOCKETS | A vulnerability was found in Linux Kernel. It has been declared as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Bluetooth · 25 (P1 23 · P2 2) | |||||
| CVE-2026-23395 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | needs reworkBackport upstream commit 5b3e2052334f — needs rework (context drifted) -> stage the patch… |
| CVE-2026-23461 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user | applies cleanlyBackport upstream commit 752a6c9596dd (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23462 | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: Fix possible UAF | applies cleanlyBackport upstream commit dbf666e4fc9b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31408 | P1 | 8.8 | BT_BREDR | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing | applies cleanlyBackport upstream commit 598dbba9919c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31773 | P1 | 8.8 | BT | Bluetooth: SMP: derive legacy responder STK authentication from MITM | applies cleanlyBackport upstream commit 20756fec2f01 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43018 | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in | applies cleanlyBackport upstream commit b255531b27da (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43334 | P1 | 8.8 | BT | Bluetooth: SMP: force responder MITM requirements before building the | applies cleanlyBackport upstream commit d05111bfe37b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46056 | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | applies cleanlyBackport upstream commit 85fa35120487 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52918 | P1 | 8.8 | BT | Bluetooth: serialize accept_q access | applies cleanlyBackport upstream commit e83f5e24da74 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53071 | P1 | 8.8 | BT | Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp | applies cleanlyBackport upstream commit 42776497cdbc (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53072 | P1 | 8.8 | BT | Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER | applies cleanlyBackport upstream commit 5c7209a341ff (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53358 | P1 | 8.8 | BT | Bluetooth: L2CAP: use chan timer to close channels in | needs reworkBackport upstream commit 8c8e620467a7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-63975 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp | applies cleanlyBackport upstream commit 41c2713b204e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64206 | P1 | 8.8 | BT | Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock | needs reworkBackport upstream commit 2641a9e0a1dd — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31393 | P1 | 8.1 | BT | Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before | applies cleanlyBackport upstream commit dd815e6e3918 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31771 | P1 | 8.1 | BT | Bluetooth: hci_event: move wake reason storage into validated event | needs reworkBackport upstream commit 2b2bf47cd755 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43134 | P1 | 8.1 | BT | Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ | applies cleanlyBackport upstream commit 138d7eca445e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46138 | P1 | 8.1 | BT | Bluetooth: hci_event: Fix OOB read and infinite loop in | applies cleanlyBackport upstream commit 5ddb80142611 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53254 | P1 | 8.1 | BT_RFCOMM | Bluetooth: RFCOMM: validate skb length in MCC handlers | applies cleanlyBackport upstream commit 23882b828c3c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53256 | P1 | 8.0 | BT_RFCOMM | Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() | applies cleanlyBackport upstream commit 43c441edacf9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53357 | P1 | 8.0 | BT | Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() | applies cleanlyBackport upstream commit ab1513597c6c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43062 | P1 | 7.1 | BT | Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() | applies cleanlyBackport upstream commit 15145675690c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64403 | P1 | 7.1 | BT | Bluetooth: L2CAP: validate option length before reading conf opt | applies cleanlyBackport upstream commit 687617555ced (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2022-42895 | P2 | 6.5 | BT | There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3619 | P2 | 3.5 | BT | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Network stack · 17 (P0 8 · P1 9) | |||||
| CVE-2025-38472 | P0 | 9.8 | NF_CONNTRACK | netfilter: nf_conntrack: fix crash due to removal of uninitialised | applies cleanlyBackport upstream commit 2d72afb34065 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31414 | P0 | 9.8 | NF_CONNTRACK | netfilter: nf_conntrack_expect: use expect->helper | needs reworkBackport upstream commit f01794106042 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43037 | P0 | 9.8 | IPV6_TUNNEL | ip6_tunnel: clear skb2->cb[] in ip4ip6_err() | applies cleanlyBackport upstream commit 2edfa31769a4 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53002 | P0 | 9.8 | NF_NAT_AMANDA | netfilter: conntrack: remove sprintf usage | applies cleanlyBackport upstream commit 6e7066bdb481 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53221 | P0 | 9.8 | IPV6_VTI | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | applies cleanlyBackport upstream commit a5c0359f5cbc (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53228 | P0 | 9.8 | IPV6_SIT | ipv6: sit: reload inner IPv6 header after GSO offloads | applies cleanlyBackport upstream commit f0e42f0c4337 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53131 | P0 | 9.4 | NF_LOG_SYSLOG | netfilter: require Ethernet MAC header before using eth_hdr() | needs reworkBackport upstream commit 62443dc21114 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-23455 | P0 | 9.1 | NF_CONNTRACK_H323 | netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() | applies cleanlyBackport upstream commit f173d0f4c0f6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52920 | P1 | 8.3 | NETFILTER_XT_MATCH_POLICY | netfilter: xt_policy: fix strict mode inbound policy matching | applies cleanlyBackport upstream commit 4b2b4d7d4e20 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23456 | P1 | 8.2 | NF_CONNTRACK_H323 | netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case | applies cleanlyBackport upstream commit 1e3a3593162c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43233 | P1 | 8.2 | NF_CONNTRACK_H323 | netfilter: nf_conntrack_h323: fix OOB read in decode_choice() | applies cleanlyBackport upstream commit baed0d9ba91d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53268 | P1 | 8.2 | NF_CONNTRACK_IRC | netfilter: conntrack_irc: fix possible out-of-bounds read | applies cleanlyBackport upstream commit 66eba0ffce3b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23003 | P1 | 7.5 | IPV6_TUNNEL | ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() | applies cleanlyBackport upstream commit 81c734dae203 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23139 | P1 | 7.5 | NETFILTER_CONNCOUNT | netfilter: nf_conncount: update last_gc only when GC has been | needs reworkBackport upstream commit 7811ba452402 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-45859 | P1 | 7.5 | NETFILTER_NETLINK_QUEUE | netfilter: nfnetlink_queue: do shared-unconfirmed check before | needs reworkBackport upstream commit 207b3ebacb61 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-45860 | P1 | 7.5 | NETFILTER_CONNCOUNT | netfilter: nf_conncount: increase the connection clean up limit to 64 | needs reworkBackport upstream commit 21d033e47273 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64414 | P1 | 7.5 | NF_DEFRAG_IPV6 | netfilter: handle unreadable frags | applies cleanlyBackport upstream commit da5b58478a9c (applies cleanly) -> stage the patch in meta-optisi… |
| Unmapped (older advisories) · 13 (P0 1 · P1 7 · P2 5) | |||||
| CVE-2026-43071 | P0 | 9.1 | unmapped | dcache: Limit the minimal number of bucket to two | applies cleanlyBackport upstream commit f08fe8891c3e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71072 | P1 | 8.2 | unmapped | shmem: fix recovery on rename failures | applies cleanlyBackport upstream commit e1b4c6a58304 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64368 | P1 | 8.1 | unmapped | mm/slab: do not limit zeroing to orig_size when only red zoning is | applies cleanlyBackport upstream commit 648927ceb840 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2020-1749 | P1 | 7.5 | unmapped | A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2020-25672 | P1 | 7.5 | unmapped | A memory leak vulnerability was found in Linux kernel in llcp_sock_connect | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2026-64374 | P1 | 7.5 | unmapped | sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT | applies cleanlyBackport upstream commit dd29c017aed6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2019-14899 | P1 | 7.4 | unmapped | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2008-4609 | P1 | 7.1 | unmapped | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-6240 | P2 | 6.5 | unmapped | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-2663 | P2 | 5.3 | unmapped | An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2010-4563 | P2 | 5.0 | unmapped | The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3567 | P2 | 4.6 | unmapped | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3630 | P2 | 3.1 | unmapped | A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Ethernet driver · 1 (P1 1) | |||||
| CVE-2026-53232 | P1 | 8.8 | PHYLIB | net: phy: clean the sfp upstream if phy probing fails | needs reworkBackport upstream commit 48774e87bbaa — needs rework (context drifted) -> stage the patch… |
Patches go beside meta-optisigns-vendor-amlogic/recipes-kernel/linux/linux-meson_6.12.bb in cve-archive/, named by no recipe until adopted; kernel C patches are never shared across vendor trees.
4 / 6 · Userland
138 rows in 26 packages still need a fix. One version change per package closes its rows. The target is the lowest version that closes every row with a known affected range.
| Package | Now | Target | Rows | Where the change goes |
|---|---|---|---|---|
| ffmpeg-remux | 5.0.3 | ≥2025-01-13 | 30 | bump meta-optisigns-poky4/recipes-optisigns-common/ffmpeg-remux/ffmpeg-remux_5.0.3.bb |
| rsync | 2.6.9 | ≥3.5.0 | 18 | Amlogic only: copy the upstream recipe dir (kirkstone/meta-gplv2/recipes-devtools/rsync/, all its files) to meta-optisigns-poky4/recipes-cve/rsync/ as rsync_<new>.bb, pin PREFERRED_VERSION_rsync in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/rsync/rsync_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_rsync / _lib32-rsync at the old version and pins the new one as PREFERRED_VERSION_rsync:k6.12 + PREFERRED_VERSION_lib32-rsync:k6.12 (verify with bitbake-getvar in img_panthor) |
| glib-2.0 | 2.72.3 | ≥2.88.1 | 10 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-core/glib-2.0/, all its files) to meta-optisigns-poky4/recipes-cve/glib-2.0/ as glib-2.0_<new>.bb, pin PREFERRED_VERSION_glib-2.0 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/glib-2.0/glib-2.0_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_glib-2.0 / _lib32-glib-2.0 at the old version and pins the new one as PREFERRED_VERSION_glib-2.0:k6.12 + PREFERRED_VERSION_lib32-glib-2.0:k6.12 (verify with bitbake-getvar in img_panthor) |
| bluez5 | 5.66 | ≥5.70 | 9 | bump meta-optisigns-poky4/recipes-connectivity/bluez5/bluez5_5.66.bb |
| glibc | 2.35 | — | 9 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-core/glibc/, all its files) to meta-optisigns-poky4/recipes-cve/glibc/ as glibc_<new>.bb, pin PREFERRED_VERSION_glibc in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/glibc/glibc_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_glibc / _lib32-glibc at the old version and pins the new one as PREFERRED_VERSION_glibc:k6.12 + PREFERRED_VERSION_lib32-glibc:k6.12 (verify with bitbake-getvar in img_panthor) |
| python3 | 3.10.18 | ≥3.14.7 | 8 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-devtools/python/, all its files) to meta-optisigns-poky4/recipes-cve/python3/ as python3_<new>.bb, pin PREFERRED_VERSION_python3 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/python3/python3_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_python3 / _lib32-python3 at the old version and pins the new one as PREFERRED_VERSION_python3:k6.12 + PREFERRED_VERSION_lib32-python3:k6.12 (verify with bitbake-getvar in img_panthor) |
| cups | 2.4.2 | ≥2.4.17 | 6 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-extended/cups/, all its files) to meta-optisigns-poky4/recipes-cve/cups/ as cups_<new>.bb, pin PREFERRED_VERSION_cups in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/cups/cups_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_cups / _lib32-cups at the old version and pins the new one as PREFERRED_VERSION_cups:k6.12 + PREFERRED_VERSION_lib32-cups:k6.12 (verify with bitbake-getvar in img_panthor) |
| expat | 2.2.9 | >2.8.3 | 6 | Amlogic only: copy the upstream recipe dir (kirkstone/meta-meson/recipes-core/expat/, all its files) to meta-optisigns-poky4/recipes-cve/expat/ as expat_<new>.bb, pin PREFERRED_VERSION_expat in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/expat/expat_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_expat / _lib32-expat at the old version and pins the new one as PREFERRED_VERSION_expat:k6.12 + PREFERRED_VERSION_lib32-expat:k6.12 (verify with bitbake-getvar in img_panthor) |
| gstreamer1.0 | 1.20.7 | ≥1.28.1 | 6 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-multimedia/gstreamer/, all its files) to meta-optisigns-poky4/recipes-cve/gstreamer1.0/ as gstreamer1.0_<new>.bb, pin PREFERRED_VERSION_gstreamer1.0 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/gstreamer1.0/gstreamer1.0_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_gstreamer1.0 / _lib32-gstreamer1.0 at the old version and pins the new one as PREFERRED_VERSION_gstreamer1.0:k6.12 + PREFERRED_VERSION_lib32-gstreamer1.0:k6.12 (verify with bitbake-getvar in img_panthor) |
| openssl | 3.0.21 | ≥3.0.23 | 6 | bump meta-optisigns-poky4/recipes-cve/openssl/openssl_3.0.21.bb |
| faad2 | 2.10.0 | >2.10.0 | 5 | no fixed upstream release (the fix is only after 2.10.0, which is current): carry patches in kirkstone/meta-meson/recipes-multimedia/faad2/faad2_2.10.0.bb |
| libpng | 1.6.39 | ≥1.6.56 | 5 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-multimedia/libpng/, all its files) to meta-optisigns-poky4/recipes-cve/libpng/ as libpng_<new>.bb, pin PREFERRED_VERSION_libpng in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/libpng/libpng_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_libpng / _lib32-libpng at the old version and pins the new one as PREFERRED_VERSION_libpng:k6.12 + PREFERRED_VERSION_lib32-libpng:k6.12 (verify with bitbake-getvar in img_panthor) |
14 rows have no affected range in NVD and need a manual check before acting.
| CVE | Priority | CVSS | What it is | Fix suggestion |
|---|---|---|---|---|
| ffmpeg-remux 5.0.3 → ≥2025-01-13 · 30 (P1 14 · P2 16) | ||||
| CVE-2026-64830 | P1 | 8.8 | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-64832 | P1 | 8.8 | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-64835 | P1 | 8.8 | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66036 | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66039 | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66040 | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2022-48434 | P1 | 8.1 | libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves… | Upgrade ffmpeg 5.0.3 → ≥5.1.2 |
| CVE-2023-6603 | P1 | 7.5 | A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-30997 | P1 | 7.5 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-30998 | P1 | 7.5 | An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-30999 | P1 | 7.5 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-64834 | P1 | 7.5 | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2023-6605 | P1 | 7.2 | A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-64833 | P1 | 7.1 | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2025-25468 | P2 | 6.5 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the… | Upgrade ffmpeg 5.0.3 → ≥2025-01-13 |
| CVE-2025-25469 | P2 | 6.5 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the… | Upgrade ffmpeg 5.0.3 → ≥2025-01-13 |
| CVE-2026-107695 | P2 | 6.5 | FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| CVE-2026-107696 | P2 | 6.5 | FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in… | Upgrade ffmpeg 5.0.3 → >9.0.2 |
| CVE-2026-66037 | P2 | 6.5 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66038 | P2 | 6.5 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2024-7272 | P2 | 6.3 | A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This… | Upgrade ffmpeg 5.0.3 → ≥5.1.6 |
| CVE-2025-1594 | P2 | 6.3 | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects… | Upgrade ffmpeg 5.0.3 → >7.1 |
| CVE-2026-107675 | P2 | 5.9 | FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… | Upgrade ffmpeg 5.0.3 → >9.0.2 |
| CVE-2026-107698 | P2 | 5.4 | FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery… | Upgrade ffmpeg 5.0.3 → ≥7.1.4 |
| CVE-2023-6602 | P2 | 5.3 | A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2023-6604 | P2 | 5.3 | A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2025-10256 | P2 | 5.3 | A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter… | Upgrade ffmpeg 5.0.3 → ≥8.0 |
| CVE-2026-107660 | P2 | 4.8 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| CVE-2023-6601 | P2 | 4.7 | A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-107697 | P2 | 4.3 | FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| rsync 2.6.9 → ≥3.5.0 · 18 (P0 5 · P1 6 · P2 7) | ||||
| CVE-2007-6200 | P0 | 10.0 | Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon,… | NVD confirms 2.6.9 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2017-15994 | P0 | 9.8 | rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier… | Upgrade rsync 2.6.9 → >3.1.2 |
| CVE-2017-17434 | P0 | 9.8 | The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for… | Upgrade rsync 2.6.9 → >3.1.2 |
| CVE-2007-6199 | P0 | 9.3 | rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows… | NVD confirms 2.6.9 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2026-53791 | P0 | 9.1 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-43618 | P1 | 8.1 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-53795 | P1 | 8.1 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2014-2855 | P1 | 7.8 | The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers… | Upgrade rsync 2.6.9 → >3.1.0 |
| CVE-2008-1720 | P1 | 7.5 | Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled,… | NVD confirms 2.6.9 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2018-5764 | P1 | 7.5 | The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent… | Upgrade rsync 2.6.9 → ≥3.1.3 |
| CVE-2022-29154 | P1 | 7.4 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write… | Upgrade rsync 2.6.9 → ≥3.2.5 |
| CVE-2026-43620 | P2 | 6.5 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-53786 | P2 | 6.5 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53789 | P2 | 6.5 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53801 | P2 | 5.9 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53798 | P2 | 5.3 | rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-43617 | P2 | 4.8 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-45232 | P2 | 3.1 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in… | Upgrade rsync 2.6.9 → ≥3.4.3 |
| glib-2.0 2.72.3 → ≥2.88.1 · 10 (P0 2 · P1 7 · P2 1) | ||||
| CVE-2025-14087 | P0 | 9.8 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause… | Upgrade glib 2.72.3 → ≥2.86.3 |
| CVE-2026-58016 | P0 | 9.1 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2026-58014 | P1 | 8.6 | A flaw was found in GLib. An off-by-one error can occur in the… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2026-58010 | P1 | 8.2 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58012 | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58013 | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2025-4056 | P1 | 7.5 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application… | Upgrade glib 2.72.3 → ≥2.84.1 |
| CVE-2026-58011 | P1 | 7.5 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58015 | P1 | 7.5 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2025-14512 | P2 | 6.5 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and… | Upgrade glib 2.72.3 → ≥2.86.3 |
| bluez5 5.66 → ≥5.70 · 9 (P1 5 · P2 4) | ||||
| CVE-2023-27349 | P1 | 7.1 | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-44431 | P1 | 7.1 | BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-50229 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-50230 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-51596 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51580 | P2 | 5.4 | BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51589 | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51592 | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51594 | P2 | 2.6 | BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| glibc 2.35 → no fixed release · 9 (P0 1 · P1 6 · P2 2) | ||||
| CVE-2026-5450 | P0 | 9.8 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C… | Upgrade glibc 2.35 → >2.43 |
| CVE-2025-15281 | P1 | 7.5 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version… | Upgrade glibc 2.35 → ≥2.43 |
| CVE-2026-0915 | P1 | 7.5 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.42 |
| CVE-2026-4046 | P1 | 7.5 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-4437 | P1 | 7.5 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-5928 | P1 | 7.5 | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-5435 | P1 | 7.3 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version… | NVD confirms 2.35 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2026-6238 | P2 | 6.5 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version… | NVD confirms 2.35 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2026-4438 | P2 | 5.4 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.43 |
| python3 3.10.18 → ≥3.14.7 · 8 (P1 5 · P2 3) | ||||
| CVE-2025-13836 | P1 | 7.5 | When reading an HTTP response from a server, if no read amount is specified, the default… | Upgrade python 3.10.18 → ≥3.10.20 |
| CVE-2026-15308 | P1 | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through… | Upgrade python 3.10.18 → ≥3.10.21 |
| CVE-2026-3087 | P1 | 7.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a… | Upgrade python 3.10.18 → >3.14.4 |
| CVE-2026-3644 | P1 | 7.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… | Upgrade python 3.10.18 → ≥3.13.13 |
| CVE-2026-7210 | P1 | 7.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat… | Upgrade python 3.10.18 → ≥3.13.14 |
| CVE-2026-6019 | P2 | 6.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for… | Upgrade python 3.10.18 → ≥3.13.14 |
| CVE-2025-12084 | P2 | 5.3 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a… | Upgrade python 3.10.18 → ≥3.13.11 |
| CVE-2025-12781 | P2 | 5.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions… | Upgrade python 3.10.18 → ≥3.13.10 |
| cups 2.4.2 → ≥2.4.17 · 6 (P1 1 · P2 5) | ||||
| CVE-2026-34980 | P1 | 7.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2025-58364 | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → ≥2.4.13 |
| CVE-2026-34978 | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2026-34979 | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2026-27447 | P2 | 4.8 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2026-41079 | P2 | 4.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → ≥2.4.17 |
| expat 2.2.9 → >2.8.3 · 6 (P1 5 · P2 1) | ||||
| CVE-2023-52425 | P1 | 7.5 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full… | Upgrade libexpat 2.2.9 → >2.5.0 |
| CVE-2024-28757 | P1 | 7.5 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of… | Upgrade libexpat 2.2.9 → ≥2.6.2 |
| CVE-2024-45490 | P1 | 7.5 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length… | Upgrade libexpat 2.2.9 → ≥2.6.3 |
| CVE-2025-59375 | P1 | 7.5 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations… | Upgrade libexpat 2.2.9 → ≥2.7.2 |
| CVE-2026-66046 | P1 | 7.5 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic… | Upgrade libexpat 2.2.9 → >2.8.3 |
| CVE-2024-50602 | P2 | 5.9 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser… | Upgrade libexpat 2.2.9 → ≥2.6.4 |
| gstreamer1.0 1.20.7 → ≥1.28.1 · 6 (P1 4 · P2 2) | ||||
| CVE-2025-3887 | P1 | 8.8 | GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | Upgrade gstreamer 1.20.7 → ≥1.26.1 |
| CVE-2026-3083 | P1 | 8.8 | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.20.7 → ≥1.28.1 |
| CVE-2026-3085 | P1 | 8.8 | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.20.7 → ≥1.28.1 |
| CVE-2025-47219 | P1 | 8.1 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| CVE-2025-47806 | P2 | 5.6 | In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| CVE-2025-47808 | P2 | 5.6 | In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| openssl 3.0.21 → ≥3.0.23 · 6 (P1 1 · P2 5) | ||||
| CVE-2026-84782 | P1 | 8.2 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-35189 | P2 | 5.3 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-75805 | P2 | 5.3 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-75806 | P2 | 5.3 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-54872 | P2 | 3.7 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-77696 | P2 | 3.7 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values,… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| faad2 2.10.0 → >2.10.0 · 5 (P1 4 · P2 1) | ||||
| CVE-2021-32273 | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32274 | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32277 | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32278 | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32276 | P2 | 5.5 | An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the… | Upgrade faad2 2.10.0 → >2.10.0 |
| libpng 1.6.39 → ≥1.6.56 · 5 (P1 5) | ||||
| CVE-2026-25646 | P1 | 8.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.55 |
| CVE-2026-33636 | P1 | 7.6 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.56 |
| CVE-2026-33416 | P1 | 7.5 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.56 |
| CVE-2025-64720 | P1 | 7.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.51 |
| CVE-2025-66293 | P1 | 7.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.52 |
| gawk 3.1.5 → >5.4.0 · 3 (P0 1 · P1 2) | ||||
| CVE-2026-40468 | P0 | 9.1 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue… | Upgrade gawk 3.1.5 → >5.4.0 |
| CVE-2026-40467 | P1 | 7.5 | Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir()… | Upgrade gawk 3.1.5 → >5.4.0 |
| CVE-2026-40553 | P1 | 7.5 | Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk… | Upgrade gawk 3.1.5 → >5.4.0 |
| coreutils 6.9 → >8.23 · 2 (P0 1 · P1 1) | ||||
| CVE-2015-4042 | P0 | 9.8 | Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23… | Upgrade coreutils 6.9 → >8.23 |
| CVE-2014-9471 | P1 | 7.5 | The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of… | Upgrade coreutils 6.9 → ≥8.23 |
| dnsmasq 2.90 → ≥2.93 · 2 (P2 2) | ||||
| CVE-2026-12725 | P2 | 5.9 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging… | Upgrade dnsmasq 2.90 → ≥2.93 |
| CVE-2026-12969 | P2 | 5.3 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c.… | Upgrade dnsmasq 2.90 → ≥2.93 |
| libsndfile1 1.0.31 → >1.2.2 · 2 (P1 1 · P2 1) | ||||
| CVE-2025-52194 | P1 | 7.5 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier… | Upgrade libsndfile 1.0.31 → >1.2.2 |
| CVE-2024-50613 | P2 | 6.5 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in… | Upgrade libsndfile 1.0.31 → >1.2.2 |
| sqlite3 3.38.5 → ≥3.51.1 · 2 (P1 2) | ||||
| CVE-2025-6965 | P1 | 7.7 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate… | Upgrade sqlite 3.38.5 → ≥3.50.2 |
| CVE-2025-70873 | P1 | 7.5 | An information disclosure issue in the zipfileInflate function in the zipfile extension in… | Upgrade sqlite 3.38.5 → ≥3.51.1 |
| boost 1.78.0 → no fixed release · 1 (P2 1) | ||||
| CVE-2009-3654 | P2 | 6.4 | Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote… | Upgrade boost 1.78.0 → >6.x-1.01 |
| busybox 1.35.0 → >1.37.0 · 1 (P2 1) | ||||
| CVE-2025-60876 | P2 | 6.5 | BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the… | Upgrade busybox 1.35.0 → >1.37.0 |
| harfbuzz 4.0.1 → ≥12.3.0 · 1 (P2 1) | ||||
| CVE-2026-22693 | P2 | 5.3 | HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference… | Upgrade harfbuzz 4.0.1 → ≥12.3.0 |
| libgcc 11.5.0 → ≥2023-09-12 · 1 (P2 1) | ||||
| CVE-2023-4039 | P2 | 4.8 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target… | Upgrade gcc 11.5.0 → ≥2023-09-12 |
| mesa 24.1.7 → ≥25.3.6 · 1 (P1 1) | ||||
| CVE-2026-40393 | P1 | 8.1 | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU… | Upgrade mesa 24.1.7 → ≥25.3.6 |
| ncurses 6.3+20220423 → >6.3 · 1 (P1 1) | ||||
| CVE-2022-29458 | P1 | 7.1 | ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in… | NVD confirms 6.3+20220423 (exact version / open range) but names no fixed release: find t… |
| speex 1.2.0 → >1.2 · 1 (P2 1) | ||||
| CVE-2020-23904 | P2 | 5.5 | A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of… | NVD confirms 1.2.0 (exact version / open range) but names no fixed release: find the upst… |
| wpa-supplicant 2.10 → >2.10 · 1 (P2 1) | ||||
| CVE-2023-52160 | P2 | 6.5 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a… | Upgrade wpa_supplicant 2.10 → >2.10 |
| xz 5.2.6 → ≥5.8.3 · 1 (P2 1) | ||||
| CVE-2026-34743 | P2 | 5.3 | XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to… | Upgrade xz 5.2.6 → ≥5.8.3 |
5 / 6 · U-Boot
U-Boot 2023.01: 10 CVEs still need a fix; 1 ruled out on evidence from this build. Bootloader changes go last in the fix plan.
| CVE | Priority | CVSS | What it is | Fix |
|---|---|---|---|---|
| CVE-2026-29009 | P1 | 8.2 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply()… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2026-46728 | P1 | 8.2 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-42040 | P1 | 8.1 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57254 | P1 | 7.1 | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57255 | P1 | 7.1 | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57256 | P1 | 7.1 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57258 | P1 | 7.1 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57259 | P1 | 7.1 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2026-29007 | P2 | 5.3 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57257 | P2 | 2.0 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE | Ruling | Reason |
|---|---|---|
| CVE-2026-29008 | stored-judgement | integer underflow in tcp_rx_state_machine() (net/tcp.c); our 2023.01 U-Boot has no TCP stack (net/tcp.c absent, no CONFIG_PROT_TCP). The summary also names sto… |
ledger
From the in-repo ledger docs/security/cve/amlinux: 5 fix record(s) merged here. Work on other branches is not shown.
Still need a fix: 258
| Record | Fixed by | Date | MR | CVEs fixed | In this image |
|---|---|---|---|---|---|
| amlinux-cve-fix-001 | wilber | 2026-10-14 | !465 | 13 | all |
| amlinux-cve-fix-002 | wilber | 2026-10-14 | !465 | 5 | all |
| amlinux-cve-fix-003 | wilber | 2026-10-14 | !465 | 2 | all |
| amlinux-cve-fix-004 | wilber | 2026-10-15 | !482 | 29 | all |
| amlinux-cve-fix-005 | wilber | 2026-10-15 | !482 | 11 | all |
| CVE | Fixed by | Date | Record | MR | Now |
|---|---|---|---|---|---|
| CVE-2024-45491 | wilber | 2026-10-14 | amlinux-cve-fix-003 | !465 | fixed |
| CVE-2024-45492 | wilber | 2026-10-14 | amlinux-cve-fix-003 | !465 | fixed |
| CVE-2025-38512 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-38643 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-39770 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2025-39849 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-39864 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-6021 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2025-71080 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2025-71127 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-0989 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-0990 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-13608 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-18924 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-19931 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-23246 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-43038 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43083 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43099 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43101 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43139 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43186 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43194 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43198 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43341 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43452 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43501 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46037 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46125 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46152 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46166 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46244 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46266 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46306 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52945 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52981 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52982 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-53006 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53069 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53184 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53235 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53275 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-54874 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63072 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63074 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63076 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63992 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-63994 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64024 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64116 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64132 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64223 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-6653 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-75803 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-80229 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80230 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80231 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80255 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-82208 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-82209 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
6 / 6 · Fix plan
One change per step, each built, bench-tested and revertable on its own. Start at the top.
| # | Fix and how | Closes | Risks | Rollback |
|---|---|---|---|---|
| 1 | Recommended · do first Patch 12 leaf packages, one commit each
| 78 userland rows |
| Revert that package's commit; nothing else depends on it. |
| 2 | Recommended Backport the 70 kernel fixes that apply cleanly, as one series
| 70 kernel rows |
| Drop the series from the recipe; on a device, the A/B slot falls back after three failed boots. |
| 3 | Next Patch the 8 foundation packages, each on its own
| 42 userland rows |
| Revert that package's commit; the rest of the batch stays. |
| 4 | As time allows Hand-check the rest
| 62 rows |
| Each is its own commit. |
| 5 | Last Fix U-Boot 2023.01, last
| 10 U-Boot rows |
| Revert the SRC_URI change and reflash the previous loader through the bench rails. |
Every number on these pages comes from fixlist.json for the build and NVD snapshot named on page 1; re-run when either changes. Full list with each fix: fixlist.html.