1 / 6 · Summary
Open in this image: 263 · open on the trunk: 263
| Build | cve-scan-1f846c1a · board proplayer-gen5 |
| BUILD_ID | 20261012T090758Z-cve39018124-1f846c1aa |
| Manifest | core-image-weston-gaidatech-evb-giada-dn84-20261012090443.manifest |
| Also scanned | boot.img: core-image-rk3576-ab-initramfs-gaidatech-evb-giada-dn84-20261012085923.manifest · recovery.img: core-image-rk3576-recovery-initramfs-gaidatech-evb-giada-dn84-20261012090803.manifest |
| Source | develop-rockchip @ 1f846c1a · run branch cve-scan/rk-20261012-1607 |
| Versions | kernel 6.1.99 · U-Boot 2017.09 · browser engine not found |
| NVD data | 2026-10-12 09:07 UTC · scanned 2026-10-12 09:11 UTC |
| Data version | nvd 2026-10-12T09:07 · cna b3dd75ac · bulletin rockchip 26a75f8d · rules fbb26012 |
| Vendor bulletins | 4,674 CVEs |
| Kernel "fixed in source" check | network-reachable CVEs only (run with --fixed-status for all) |
What to do: the ranked fix plan, with risks and rollback, is on page 6.
2 / 6 · Triage
Every CVE matched against this image lands in exactly one bucket, and the run refuses to finish if one falls through. Exclusions come from the build itself: the shipped kernel .config, the objects the U-Boot build produced, the rootfs, and fixes already in our source.
| Bucket | CVEs | Evidence |
|---|---|---|
| Needs a fix | 263 | reachable over a network, code built in, fix not in our source, and NVD confirms our version |
| Unconfirmed: NVD gives no version | 13 | only unversioned NVD rows match; re-judged every scan, never in a fix module |
| Already fixed | 155 | recipe patches 103 · CVE_STATUS 24 · SBOM patches 23 · in source 5 |
| Kernel: code not in this build | 2,317 | CONFIG off in the shipped .config, mapped through the kernel Makefiles; or another architecture |
| Local access only (low risk by ruling) | 2,046 | NVD attack vector LOCAL or PHYSICAL; the product has no root login |
| No path to the code on this product | 64 | no userspace caller, eBPF with BPF off, or U-Boot code not built |
| Not our software | 22 | NVD vendor-name collisions, other operating systems, other products |
| Browser engine, grouped | 0 | Chromium build not found: not matched |
| CVE | Priority | CVSS | Component | Why unconfirmed |
|---|---|---|---|---|
| CVE-2026-42010 | P0 | 9.8 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-33845 | P0 | 9.1 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-1584 | P1 | 7.5 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-42009 | P1 | 7.5 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-4424 | P1 | 7.5 | libarchive 3.7.9 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.7.9 |
| CVE-2026-5201 | P1 | 7.5 | gdk-pixbuf 2.42.12 | NVD lists gdk-pixbuf with no version ("-") only: unanalysed, not confirmed for 2.42.12 |
| CVE-2026-3833 | P1 | 7.4 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2023-39329 | P2 | 6.5 | openjpeg 2.5.3 | NVD lists openjpeg with no version ("-") only: unanalysed, not confirmed for 2.5.3 |
| CVE-2026-4426 | P2 | 6.5 | libarchive 3.7.9 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.7.9 |
| CVE-2023-39327 | P2 | 4.3 | openjpeg 2.5.3 | NVD lists openjpeg with no version ("-") only: unanalysed, not confirmed for 2.5.3 |
| CVE-2026-12891 | P2 | 4.3 | gstreamer 1.22.12 | NVD lists gstreamer with no version ("-") only: unanalysed, not confirmed for 1.22.12 |
| CVE-2026-3184 | P2 | 3.7 | util-linux 2.39.3 | NVD lists util-linux with no version ("-") only: unanalysed, not confirmed for 2.39.3 |
| CVE-2026-3832 | P2 | 3.7 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
unzip 14, libpcap 2, coreutils 1, busybox 1, gcc-cross-aarch64 1, wpa-supplicant 1, util-linux-libuuid 1, ofono 1, nano 1
not found: the Electron 43.0.0 runtime (meta-optisigns-poky-common/recipes-optisigns/optisigns-osui-runtime/optisigns-osui-runtime_43.0.0.bb) does not state its Chromium build, so the browser engine is not matched against NVD
bl31, OP-TEE bl32, SPL, DDR): vendor blobs, no NVD mapping.3 / 6 · Kernel
Kernel 6.1.99: 116 CVEs need a fix, by area.
21 P0 items, highest CVSS first.
| CVE | Area | What it is | CVSS |
|---|---|---|---|
| CVE-2024-44985 | IPV6 | ipv6: prevent possible UAF in ip6_xmit() | 9.8 |
| CVE-2024-50033 | SLHC | slip: make slhc_remember() more robust against malicious packets | 9.8 |
| CVE-2024-57947 | NF_TABLES | netfilter: nf_set_pipapo: fix initial map fill | 9.8 |
| CVE-2026-31405 | DVB_NET | media: dvb-net: fix OOB access in ULE extension header tables | 9.8 |
| CVE-2026-31649 | STMMAC_FULL | net: stmmac: fix integer underflow in chain mode | 9.8 |
| CVE-2026-43038 | IPV6 | ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | 9.8 |
| CVE-2026-43186 | IPV6 | ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() | 9.8 |
| CVE-2026-43198 | SYN_COOKIES | tcp: fix potential race in tcp_v6_syn_recv_sock() | 9.8 |
| CVE-2026-43341 | IPV6 | net/ipv6: ioam6: prevent schema length wraparound in trace fill | 9.8 |
| CVE-2026-43501 | IPV6 | ipv6: rpl: reserve mac_len headroom when recompressed SRH grows | 9.8 |
| CVE-2026-52982 | USB_RTL8150 | net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() | 9.8 |
| CVE-2026-53006 | IPV6 | ipv6: fix possible UAF in icmpv6_rcv() | 9.8 |
| CVE-2026-53384 | SERIAL_8250_DW | serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails | 9.8 |
| CVE-2026-63994 | INET | tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() | 9.8 |
7 more P0 items, and every fix commit, in fixlist.html.
| CVE | Priority | CVSS | Area | What it is | Fix |
|---|---|---|---|---|---|
| Bluetooth · 40 (P1 38 · P2 2) | |||||
| CVE-2024-36013 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() | applies cleanlyBackport upstream commit 4d7b41c0e439 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-38620 | P1 | 8.8 | BT_MRVL | Bluetooth: HCI: Remove HCI_AMP support | needs reworkBackport upstream commit 84a4bb6548a2 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-41062 | P1 | 8.8 | BT | bluetooth/l2cap: sync sock recv cb and release | applies cleanlyBackport upstream commit 89e856e124f9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-49950 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix uaf in l2cap_connect | needs reworkBackport upstream commit 333b4fd11e89 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-50029 | P1 | 8.8 | BT | Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync | applies cleanlyBackport upstream commit 18fd04ad856d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-53144 | P1 | 8.8 | BT | Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE | applies cleanlyBackport upstream commit b25e11f978b6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-53237 | P1 | 8.8 | BT | Bluetooth: fix use-after-free in device_for_each_child() | applies cleanlyBackport upstream commit 27aabf27fd01 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-56591 | P1 | 8.8 | BT | Bluetooth: hci_conn: Use disable_delayed_work_sync | applies cleanlyBackport upstream commit 2b0f2fc9ed62 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-21969 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd | needs reworkBackport upstream commit b4f82f9ed43a — needs rework (context drifted) -> stage the patch… |
| CVE-2026-23395 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | applies cleanlyBackport vendor commit fb4a3a26483f (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-23462 | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: Fix possible UAF | applies cleanlyBackport vendor commit 21a47a119f33 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31408 | P1 | 8.8 | BT_BREDR | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing | applies cleanlyBackport upstream commit 598dbba9919c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31773 | P1 | 8.8 | BT | Bluetooth: SMP: derive legacy responder STK authentication from MITM state | applies cleanlyBackport vendor commit 929db734d12d (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43018 | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt | applies cleanlyBackport vendor commit 59eecf0ffde1 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43334 | P1 | 8.8 | BT | Bluetooth: SMP: force responder MITM requirements before building the | applies cleanlyBackport upstream commit d05111bfe37b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46056 | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | applies cleanlyBackport upstream commit 85fa35120487 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52918 | P1 | 8.8 | BT | Bluetooth: serialize accept_q access | needs reworkBackport vendor commit 4ec17782fd18 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-53071 | P1 | 8.8 | BT | Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp | applies cleanlyBackport vendor commit 0ccd75c51f62 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53072 | P1 | 8.8 | BT | Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER | applies cleanlyBackport vendor commit c7777f534a80 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53358 | P1 | 8.8 | BT | Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() | needs reworkBackport vendor commit deb8493a8fa5 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-63975 | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp | applies cleanlyBackport vendor commit e6833e737a51 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-64178 | P1 | 8.8 | BT_BNEP | Bluetooth: bnep: Fix UAF read of dev->name | applies cleanlyBackport vendor commit 915a92182e2c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-64206 | P1 | 8.8 | BT | Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock | needs reworkBackport vendor commit 4a0bb0fd63fe — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-64408 | P1 | 8.8 | BT_BNEP | Bluetooth: bnep: pin L2CAP connection during netdev registration | applies cleanlyBackport vendor commit 551ae773ec64 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-39889 | P1 | 8.1 | BT | Bluetooth: l2cap: Check encryption key size on incoming connection | applies cleanlyBackport vendor commit c6d527bbd3d3 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31393 | P1 | 8.1 | BT | Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access | applies cleanlyBackport vendor commit 3b646516cba2 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31771 | P1 | 8.1 | BT | Bluetooth: hci_event: move wake reason storage into validated event | needs reworkBackport upstream commit 2b2bf47cd755 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43134 | P1 | 8.1 | BT | Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ | applies cleanlyBackport vendor commit 9118601ff90b (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53254 | P1 | 8.1 | BT_RFCOMM | Bluetooth: RFCOMM: validate skb length in MCC handlers | applies cleanlyBackport vendor commit 0d637136ce89 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-50124 | P1 | 8.0 | BT_LE | Bluetooth: ISO: Fix UAF on iso_sock_timeout | applies cleanlyBackport upstream commit 246b435ad668 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-50125 | P1 | 8.0 | BT | Bluetooth: SCO: Fix UAF on sco_sock_timeout | applies cleanlyBackport upstream commit 1bf4470a3939 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53256 | P1 | 8.0 | BT_RFCOMM | Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() | applies cleanlyBackport vendor commit 1f73f92f6625 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53357 | P1 | 8.0 | BT | Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() | applies cleanlyBackport vendor commit 7eebd4c2c86f (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-36968 | P1 | 7.6 | BT | Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() | needs reworkBackport upstream commit a5b862c6a221 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-56590 | P1 | 7.6 | BT | Bluetooth: hci_core: Fix not checking skb length on | applies cleanlyBackport upstream commit 3fe288a8214e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43062 | P1 | 7.1 | BT | Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() | applies cleanlyBackport vendor commit 111f74547eee (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53253 | P1 | 7.1 | BT_BNEP | Bluetooth: bnep: reject short frames before parsing | needs reworkBackport vendor commit 2b83afb19293 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-64403 | P1 | 7.1 | BT | Bluetooth: L2CAP: validate option length before reading conf opt value | applies cleanlyBackport vendor commit 7d871e969b94 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2023-28866 | P2 | 5.3 | BT | In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3619 | P2 | 3.5 | BT | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Network stack · 37 (P0 14 · P1 23) | |||||
| CVE-2024-44985 | P0 | 9.8 | IPV6 | ipv6: prevent possible UAF in ip6_xmit() | applies cleanlyBackport upstream commit 2d5ff7e339d0 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-50033 | P0 | 9.8 | SLHC | slip: make slhc_remember() more robust against malicious packets | applies cleanlyBackport upstream commit 7d3fce8cbe3a (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-57947 | P0 | 9.8 | NF_TABLES | netfilter: nf_set_pipapo: fix initial map fill | needs reworkBackport vendor commit 9625c46ce6fd — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-43038 | P0 | 9.8 | IPV6 | ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | applies cleanlyBackport vendor commit a4437faf135d (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43186 | P0 | 9.8 | IPV6 | ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() | applies cleanlyBackport vendor commit fb3c662fafeb (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43198 | P0 | 9.8 | SYN_COOKIES | tcp: fix potential race in tcp_v6_syn_recv_sock() | needs reworkBackport upstream commit 858d2a4f67ff — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43341 | P0 | 9.8 | IPV6 | net/ipv6: ioam6: prevent schema length wraparound in trace fill | applies cleanlyBackport vendor commit e96d48b37708 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43501 | P0 | 9.8 | IPV6 | ipv6: rpl: reserve mac_len headroom when recompressed SRH grows | applies cleanlyBackport upstream commit 9e6bf146b559 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53006 | P0 | 9.8 | IPV6 | ipv6: fix possible UAF in icmpv6_rcv() | applies cleanlyBackport vendor commit 38bdbc897c0d (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-63994 | P0 | 9.8 | INET | tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() | applies cleanlyBackport vendor commit bf8b3f34c37c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-47678 | P0 | 9.4 | INET | icmp: change the order of rate limits | needs reworkBackport upstream commit 8c2bd38b95f7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43083 | P0 | 9.1 | IPV6 | net: ioam6: fix OOB and missing lock | needs reworkBackport upstream commit b30b1675aa2b — needs rework (context drifted) -> stage the patch… |
| CVE-2026-46266 | P0 | 9.1 | INET | inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP | needs reworkBackport upstream commit c89477ad7944 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-63992 | P0 | 9.1 | INET | tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() | applies cleanlyBackport vendor commit 7f4f7efe7f30 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53275 | P1 | 8.8 | IPV6 | ipv6: mcast: Fix use-after-free when processing MLD queries | applies cleanlyBackport vendor commit 53baa63a4183 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43139 | P1 | 8.6 | XFRM | xfrm6: fix uninitialized saddr in xfrm6_get_saddr() | needs reworkBackport vendor commit eb2ee15290af — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-43452 | P1 | 8.2 | NETFILTER_XTABLES | netfilter: x_tables: guard option walkers against 1-byte tail reads | applies cleanlyBackport vendor commit c39f84e4be1b (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-45843 | P1 | 8.2 | SLHC | slip: bound decode() reads against the compressed packet length | applies cleanlyBackport upstream commit 4c1367a2d7aa (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46037 | P1 | 8.2 | INET | ipv4: icmp: validate reply type before using icmp_pointers | applies cleanlyBackport upstream commit 67bf002a2d73 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-44986 | P1 | 8.1 | IPV6 | ipv6: fix possible UAF in ip6_finish_output2() | applies cleanlyBackport upstream commit da273b377ae0 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-21760 | P1 | 8.1 | IPV6 | ndisc: extend RCU protection in ndisc_send_skb() | applies cleanlyBackport vendor commit a9319d800b57 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21762 | P1 | 8.1 | INET | arp: use RCU protection in arp_xmit() | applies cleanlyBackport vendor commit f18965445942 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21765 | P1 | 8.1 | IPV6 | ipv6: use RCU protection in ip6_default_advmss() | applies cleanlyBackport vendor commit 84212387caad (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21766 | P1 | 8.1 | INET | ipv4: use RCU protection in __ip_rt_update_pmtu() | needs reworkBackport vendor commit ea07480b2322 — needs rework (context drifted) -> stage the patch i… |
| CVE-2024-41007 | P1 | 7.5 | INET | tcp: avoid too many retransmit packets | needs reworkBackport upstream commit 97a9063518f1 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-42247 | P1 | 7.5 | WIREGUARD | wireguard: allowedips: avoid unaligned 64-bit memory accesses | applies cleanlyBackport upstream commit 948f991c62a4 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-49978 | P1 | 7.5 | INET | gso: fix udp gso fraglist segmentation after pull from frag_list | applies cleanlyBackport upstream commit a1e40ac5b5e9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-53124 | P1 | 7.5 | IPV6 | net: fix data-races around sk->sk_forward_alloc | needs reworkBackport upstream commit 073d89808c06 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-56644 | P1 | 7.5 | IPV6 | net/ipv6: release expired exception dst cached in socket | applies cleanlyBackport upstream commit 3301ab7d5aeb (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-56703 | P1 | 7.5 | IPV6 | ipv6: Fix soft lockups in fib6_select_path under high next hop churn | needs reworkBackport upstream commit d9ccb18f83ea — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43099 | P1 | 7.5 | INET | ipv4: icmp: fix null-ptr-deref in icmp_build_probe() | applies cleanlyBackport upstream commit fde29fd93493 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43101 | P1 | 7.5 | IPV6 | ipv6: ioam: fix potential NULL dereferences in | needs reworkBackport upstream commit 4e65a8b8daa1 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43194 | P1 | 7.5 | NET | net: consume xmit errors of GSO frames | applies cleanlyBackport vendor commit 56bd32c0edca (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-46306 | P1 | 7.5 | NET | flow_dissector: do not dissect PPPoE PFC frames | applies cleanlyBackport vendor commit 18ae9eacfc95 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-52981 | P1 | 7.5 | NET | neigh: let neigh_xmit take skb ownership | needs reworkBackport vendor commit 8a89054a1ec0 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-53184 | P1 | 7.5 | INET | udp: clear skb->dev before running a sockmap verdict | applies cleanlyBackport vendor commit 263779a6beff (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-64116 | P1 | 7.5 | IPV6 | ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() | applies cleanlyBackport vendor commit 09cbfd4b81ae (applies cleanly) -> stage the patch in meta-optisign… |
| Other drivers and core · 18 (P0 4 · P1 11 · P2 3) | |||||
| CVE-2026-31405 | P0 | 9.8 | DVB_NET | media: dvb-net: fix OOB access in ULE extension header tables | applies cleanlyBackport vendor commit 29ef43ceb121 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-52982 | P0 | 9.8 | USB_RTL8150 | net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() | needs reworkBackport vendor commit 423b5b86e14e — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-53384 | P0 | 9.8 | SERIAL_8250_DW | serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails | applies cleanlyBackport vendor commit ccdf4510a387 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31448 | P0 | 9.4 | EXT4_FS | ext4: avoid infinite loops caused by residual data | needs reworkBackport vendor commit c66545e83a80 — needs rework (context drifted) -> stage the patch i… |
| CVE-2025-38495 | P1 | 8.8 | HID | HID: core: ensure the allocated report buffer can contain the reserved report ID | applies cleanlyBackport vendor commit d3ed1d84a845 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31450 | P1 | 8.8 | EXT4_FS | ext4: publish jinode after initialization | applies cleanlyBackport vendor commit be54c0055407 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43048 | P1 | 8.8 | HID | HID: core: Mitigate potential OOB by removing bogus memset() | applies cleanlyBackport upstream commit 0a3fe972a7cb (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64313 | P1 | 8.8 | CRYPTO_ECC | crypto: ecc - Fix carry overflow in vli multiplication | applies cleanlyBackport vendor commit 24a54dfa06d0 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-47682 | P1 | 8.6 | BLK_DEV_SD | scsi: sd: Fix off-by-one error in sd_read_block_characteristics() | applies cleanlyBackport upstream commit f81eaf08385d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46303 | P1 | 8.2 | ISO9660_FS | isofs: validate Rock Ridge CE continuation extent against volume size | applies cleanlyBackport vendor commit bf1bc673c587 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-71161 | P1 | 7.5 | DM_VERITY | dm-verity: disable recursive forward error correction | needs reworkBackport upstream commit d9f3e47d3fae — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43336 | P1 | 7.5 | CRYPTO | lib/crypto: chacha: Zeroize permuted_state before it leaves scope | needs reworkBackport upstream commit e5046823f8fa — needs rework (context drifted) -> stage the patch… |
| CVE-2026-52946 | P1 | 7.5 | IO_URING | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling | applies cleanlyBackport vendor commit 32dbd5ce4be3 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-57986 | P1 | 7.1 | HID | HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections | applies cleanlyBackport vendor commit bebf542e8d7c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-46078 | P1 | 7.1 | EROFS_FS | erofs: fix the out-of-bounds nameoff handling for trailing dirents | needs reworkBackport upstream commit d18a3b5d337f — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64146 | P2 | 5.5 | EROFS_FS_XATTR | erofs: fix metabuf leak in inode xattr initialization | needs reworkBackport upstream commit 79b09c54c656 — needs rework (context drifted) -> stage the patch… |
| CVE-2022-3523 | P2 | 5.3 | MMU | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-35878 | P2 | 5.3 | OF | of: module: prevent NULL pointer dereference in vsnprintf() | needs reworkBackport upstream commit a1aa5390cc91 — needs rework (context drifted) -> stage the patch… |
| Unmapped (older advisories) · 12 (P0 1 · P1 3 · P2 8) | |||||
| CVE-2026-43071 | P0 | 9.1 | unmapped | dcache: Limit the minimal number of bucket to two | applies cleanlyBackport upstream commit f08fe8891c3e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64374 | P1 | 7.5 | unmapped | sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT | applies cleanlyBackport vendor commit 44aae426dbfd (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2019-14899 | P1 | 7.4 | unmapped | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2008-4609 | P1 | 7.1 | unmapped | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-6240 | P2 | 6.5 | unmapped | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-1206 | P2 | 5.7 | unmapped | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2010-4563 | P2 | 5.0 | unmapped | The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24857 | P2 | 4.6 | unmapped | A race condition was found in the Linux kernel's net/bluetooth device driver in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24858 | P2 | 4.6 | unmapped | A race condition was found in the Linux kernel's net/bluetooth in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24859 | P2 | 4.6 | unmapped | A race condition was found in the Linux kernel's net/bluetooth in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24860 | P2 | 4.6 | unmapped | A race condition was found in the Linux kernel's bluetooth device driver in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-21803 | P2 | 3.5 | unmapped | Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| WiFi · 5 (P1 5) | |||||
| CVE-2025-38643 | P1 | 8.8 | CFG80211 | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | needs reworkBackport upstream commit 2c5dee15239f — needs rework (context drifted) -> stage the patch… |
| CVE-2025-39849 | P1 | 8.8 | CFG80211 | wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() | applies cleanlyBackport vendor commit 8e751d463362 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-39864 | P1 | 8.8 | CFG80211 | wifi: cfg80211: fix use-after-free in cmp_bss() | applies cleanlyBackport vendor commit 6854476d9e1a (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-46125 | P1 | 8.8 | MAC80211 | wifi: mac80211: remove station if connection prep fails | needs reworkBackport upstream commit 283fc9e44ff5 — needs rework (context drifted) -> stage the patch… |
| CVE-2025-71127 | P1 | 7.1 | MAC80211 | wifi: mac80211: Discard Beacon frames to non-broadcast address | applies cleanlyBackport vendor commit 88aab153d152 (applies cleanly) -> stage the patch in meta-optisign… |
| Ethernet driver · 4 (P0 2 · P1 2) | |||||
| CVE-2026-31649 | P0 | 9.8 | STMMAC_FULL | net: stmmac: fix integer underflow in chain mode | applies cleanlyBackport vendor commit a2b68a9a476b (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-53058 | P0 | 9.4 | STMMAC_ETH | net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data | applies cleanlyBackport upstream commit 66600fac7a98 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53232 | P1 | 8.8 | PHYLIB | net: phy: clean the sfp upstream if phy probing fails | needs reworkBackport upstream commit 48774e87bbaa — needs rework (context drifted) -> stage the patch… |
| CVE-2026-46110 | P1 | 7.5 | STMMAC_ETH | net: stmmac: Prevent NULL deref when RX memory exhausted | needs reworkBackport upstream commit 0bb05e6adfa9 — needs rework (context drifted) -> stage the patch… |
Patches go beside meta-optisigns-vendor-gaidatech/recipes-kernel/linux/linux-rockchip-gaidatech_6.1.bb in cve-archive/, named by no recipe until adopted; kernel C patches are never shared across vendor trees.
4 / 6 · Userland
118 rows in 27 packages need a fix. One version change per package closes its rows. The target is the lowest version that closes every row with a known affected range.
| Package | Now | Target | Rows | Where the change goes |
|---|---|---|---|---|
| python3-aiohttp | 3.9.4 | ≥3.14.1 | 26 | RK only: copy the upstream recipe dir (poky/meta-openembedded/meta-python/recipes-devtools/python/, all its files) to meta-optisigns-rk3576-common/recipes-devtools/python3-aiohttp/ as python3-aiohttp_<new>.bb, pin PREFERRED_VERSION_python3-aiohttp in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| rsync · also in boot.img, recovery.img | 3.2.7 | ≥3.5.0 | 15 | bump meta-optisigns-poky5/recipes-cve/rsync/rsync_3.2.7.bb · ALSO INTEL |
| python3-pillow | 10.3.0 | ≥12.3.0 | 13 | RK only: copy the upstream recipe dir (poky/meta-openembedded/meta-python/recipes-devtools/python/, all its files) to meta-optisigns-rk3576-common/recipes-devtools/python3-pillow/ as python3-pillow_<new>.bb, pin PREFERRED_VERSION_python3-pillow in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| bluez5 | 5.66 | ≥5.70 | 9 | bump meta-optisigns-poky5/recipes-connectivity/bluez5/bluez5_5.66.bb · ALSO INTEL |
| glib-2.0 | 2.78.6 | ≥2.88.1 | 7 | bump meta-optisigns-poky5/recipes-cve/glib-2.0/glib-2.0_2.78.6.bb · ALSO INTEL |
| python3 · also in boot.img, recovery.img | 3.12.12 | ≥3.14.7 | 6 | bump meta-optisigns-poky5/recipes-cve/python/python3_3.12.12.bb · ALSO INTEL |
| cups | 2.4.15 | ≥2.4.17 | 5 | bump meta-optisigns-poky5/recipes-cve/cups/cups_2.4.15.bb · ALSO INTEL |
| binutils | 2.42 | >2.46 | 3 | RK only: copy the upstream recipe dir (poky/meta/recipes-devtools/binutils/, all its files) to meta-optisigns-rk3576-common/recipes-devtools/binutils/ as binutils_<new>.bb, pin PREFERRED_VERSION_binutils in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| gawk | 5.3.0 | >5.4.0 | 3 | RK only: copy the upstream recipe dir (poky/meta/recipes-extended/gawk/, all its files) to meta-optisigns-rk3576-common/recipes-extended/gawk/ as gawk_<new>.bb, pin PREFERRED_VERSION_gawk in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| jq | 1.7.1 | ≥2026-04-12 | 3 | bump meta-optisigns-poky5/recipes-cve/jq/jq_1.7.1.bb · ALSO INTEL |
| libsndfile1 | 1.2.2 | >1.2.2 | 3 | no fixed upstream release (the fix is only after 1.2.2, which is current): carry patches in meta-optisigns-poky5/recipes-cve/libsndfile/libsndfile1_1.2.2.bb · ALSO INTEL |
| dnsmasq | 2.90 | ≥2.93 | 2 | RK only: copy the upstream recipe dir (poky/meta-openembedded/meta-networking/recipes-support/dnsmasq/, all its files) to meta-optisigns-rk3576-common/recipes-support/dnsmasq/ as dnsmasq_<new>.bb, pin PREFERRED_VERSION_dnsmasq in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
27 of 27 packages sit in a layer the Intel build also uses, so their change ships to both lines and must be validated on both. 11 rows have no affected range in NVD and need a manual check before acting.
| CVE | Priority | CVSS | What it is | Fix suggestion |
|---|---|---|---|---|
| python3-aiohttp 3.9.4 → ≥3.14.1 · 26 (P0 1 · P1 16 · P2 9) | ||||
| CVE-2026-34520 | P0 | 9.1 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2024-52304 | P1 | 7.5 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.10.11 |
| CVE-2025-53643 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.12.14 |
| CVE-2025-69223 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2025-69227 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2025-69228 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2026-22815 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34513 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34516 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-47265 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.0 |
| CVE-2026-50269 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.0 |
| CVE-2026-54273 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2026-54274 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2026-54275 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2026-54277 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2026-54278 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2026-54279 | P1 | 7.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.14.1 |
| CVE-2025-69224 | P2 | 6.5 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2025-69225 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2025-69226 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2025-69229 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions… | Upgrade aiohttp 3.9.4 → ≥3.13.3 |
| CVE-2026-34514 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34517 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34518 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34519 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| CVE-2026-34525 | P2 | 5.3 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to… | Upgrade aiohttp 3.9.4 → ≥3.13.4 |
| rsync 3.2.7 → ≥3.5.0 · also in boot.img, recovery.img · 15 (P0 1 · P1 5 · P2 9) | ||||
| CVE-2026-53791 | P0 | 9.1 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70461 | P1 | 8.2 | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-43618 | P1 | 8.1 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-53795 | P1 | 8.1 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70463 | P1 | 8.1 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-41035 | P1 | 7.4 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort… | Upgrade rsync 3.2.7 → >3.4.1 |
| CVE-2026-43620 | P2 | 6.5 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-53786 | P2 | 6.5 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53789 | P2 | 6.5 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70457 | P2 | 6.5 | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53801 | P2 | 5.9 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53798 | P2 | 5.3 | rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70459 | P2 | 5.3 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-43617 | P2 | 4.8 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-45232 | P2 | 3.1 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in… | Upgrade rsync 3.2.7 → ≥3.4.3 |
| python3-pillow 10.3.0 → ≥12.3.0 · 13 (P0 1 · P1 11 · P2 1) | ||||
| CVE-2026-54058 | P0 | 9.1 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59197 | P1 | 8.2 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-25990 | P1 | 7.5 | Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may… | Upgrade pillow 10.3.0 → ≥12.1.1 |
| CVE-2026-40192 | P1 | 7.5 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of… | Upgrade pillow 10.3.0 → ≥12.2.0 |
| CVE-2026-54059 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-54060 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile()… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-55379 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-55380 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open()… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59199 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59200 | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59204 | P1 | 7.5 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59205 | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59198 | P2 | 6.5 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| bluez5 5.66 → ≥5.70 · 9 (P1 5 · P2 4) | ||||
| CVE-2023-27349 | P1 | 7.1 | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-44431 | P1 | 7.1 | BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-50229 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-50230 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-51596 | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51580 | P2 | 5.4 | BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51589 | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51592 | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51594 | P2 | 2.6 | BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| glib-2.0 2.78.6 → ≥2.88.1 · 7 (P0 1 · P1 6) | ||||
| CVE-2026-58016 | P0 | 9.1 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in… | Upgrade glib 2.78.6 → ≥2.88.1 |
| CVE-2026-58014 | P1 | 8.6 | A flaw was found in GLib. An off-by-one error can occur in the… | Upgrade glib 2.78.6 → ≥2.88.1 |
| CVE-2026-58010 | P1 | 8.2 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in… | Upgrade glib 2.78.6 → ≥2.86.5 |
| CVE-2026-58012 | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when… | Upgrade glib 2.78.6 → ≥2.86.5 |
| CVE-2026-58013 | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in… | Upgrade glib 2.78.6 → ≥2.88.1 |
| CVE-2026-58011 | P1 | 7.5 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the… | Upgrade glib 2.78.6 → ≥2.86.5 |
| CVE-2026-58015 | P1 | 7.5 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL… | Upgrade glib 2.78.6 → ≥2.88.1 |
| python3 3.12.12 → ≥3.14.7 · also in boot.img, recovery.img · 6 (P1 4 · P2 2) | ||||
| CVE-2026-15308 | P1 | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through… | Upgrade python 3.12.12 → ≥3.12.14 |
| CVE-2026-3087 | P1 | 7.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a… | Upgrade python 3.12.12 → >3.14.4 |
| CVE-2026-3644 | P1 | 7.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… | Upgrade python 3.12.12 → ≥3.13.13 |
| CVE-2026-7210 | P1 | 7.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat… | Upgrade python 3.12.12 → ≥3.13.14 |
| CVE-2026-6019 | P2 | 6.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for… | Upgrade python 3.12.12 → ≥3.13.14 |
| CVE-2025-12781 | P2 | 5.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions… | Upgrade python 3.12.12 → ≥3.13.10 |
| cups 2.4.15 → ≥2.4.17 · 5 (P1 1 · P2 4) | ||||
| CVE-2026-34980 | P1 | 7.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-34978 | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-34979 | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-27447 | P2 | 4.8 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-41079 | P2 | 4.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → ≥2.4.17 |
| binutils 2.42 → >2.46 · 3 (P1 2 · P2 1) | ||||
| CVE-2025-69649 | P1 | 7.5 | GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when… | Upgrade binutils 2.42 → >2.46 |
| CVE-2025-69650 | P1 | 7.5 | GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted… | Upgrade binutils 2.42 → >2.46 |
| CVE-2025-0840 | P2 | 5.0 | A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43.… | Upgrade binutils 2.42 → ≥2.44 |
| gawk 5.3.0 → >5.4.0 · 3 (P0 1 · P1 2) | ||||
| CVE-2026-40468 | P0 | 9.1 | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue… | Upgrade gawk 5.3.0 → >5.4.0 |
| CVE-2026-40467 | P1 | 7.5 | Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir()… | Upgrade gawk 5.3.0 → >5.4.0 |
| CVE-2026-40553 | P1 | 7.5 | Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk… | Upgrade gawk 5.3.0 → >5.4.0 |
| jq 1.7.1 → ≥2026-04-12 · 3 (P1 1 · P2 2) | ||||
| CVE-2026-32316 | P1 | 8.2 | jq is a command-line JSON processor. An integer overflow vulnerability exists through version… | Upgrade jq 1.7.1 → >1.8.1 |
| CVE-2026-39979 | P2 | 6.5 | jq is a command-line JSON processor. In commits before… | Upgrade jq 1.7.1 → ≥2026-04-12 |
| CVE-2026-33948 | P2 | 5.3 | jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b… | Upgrade jq 1.7.1 → ≥1.8.2 |
| libsndfile1 1.2.2 → >1.2.2 · 3 (P1 2 · P2 1) | ||||
| CVE-2025-52194 | P1 | 7.5 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier… | Upgrade libsndfile 1.2.2 → >1.2.2 |
| CVE-2026-37555 | P1 | 7.5 | An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was… | NVD confirms 1.2.2 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2024-50613 | P2 | 6.5 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in… | Upgrade libsndfile 1.2.2 → >1.2.2 |
| dnsmasq 2.90 → ≥2.93 · 2 (P2 2) | ||||
| CVE-2026-12725 | P2 | 5.9 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging… | Upgrade dnsmasq 2.90 → ≥2.93 |
| CVE-2026-12969 | P2 | 5.3 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c.… | Upgrade dnsmasq 2.90 → ≥2.93 |
| gstreamer1.0 1.22.12 → ≥1.28.1 · 2 (P1 2) | ||||
| CVE-2026-3083 | P1 | 8.8 | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.22.12 → ≥1.28.1 |
| CVE-2026-3085 | P1 | 8.8 | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.22.12 → ≥1.28.1 |
| libsolv 0.7.28 → >0.7.36 · 2 (P2 2) | ||||
| CVE-2026-9149 | P2 | 6.5 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim… | Upgrade libsolv 0.7.28 → >0.7.36 |
| CVE-2026-9150 | P2 | 6.5 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in… | Upgrade libsolv 0.7.28 → >0.7.36 |
| libxml2 2.12.10 → ≥2.15.2 · also in boot.img, recovery.img · 2 (P2 2) | ||||
| CVE-2026-0990 | P2 | 5.9 | A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability… | Upgrade libxml2 2.12.10 → ≥2.15.2 |
| CVE-2026-0989 | P2 | 3.7 | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema… | Upgrade libxml2 2.12.10 → ≥2.15.2 |
| luajit 2.1 → >2.1.0_beta3 · 2 (P1 2) | ||||
| CVE-2020-15890 | P1 | 7.5 | LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is… | NVD confirms 2.1 (exact version / open range) but names no fixed release: find the upstre… |
| CVE-2020-24372 | P1 | 7.5 | LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. | NVD confirms 2.1 (exact version / open range) but names no fixed release: find the upstre… |
| perl 5.38.4 → >5.43.9 · 2 (P0 2) | ||||
| CVE-2026-4176 | P0 | 9.8 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before… | Upgrade perl 5.38.4 → ≥5.40.4 |
| CVE-2026-13221 | P0 | 9.1 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10… | Upgrade perl 5.38.4 → >5.43.9 |
| protobuf 4.25.3 → >33.4 · 2 (P1 2) | ||||
| CVE-2024-7254 | P1 | 7.5 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of… | Upgrade protobuf 4.25.3 → ≥4.27.5 |
| CVE-2026-0994 | P1 | 7.5 | A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in… | Upgrade protobuf 4.25.3 → >33.4 |
| python3-cryptography 42.0.5 → ≥46.0.6 · 2 (P2 2) | ||||
| CVE-2026-26007 | P2 | 6.5 | cryptography is a package designed to expose cryptographic primitives and recipes to Python… | Upgrade cryptography 42.0.5 → ≥46.0.5 |
| CVE-2026-34073 | P2 | 5.3 | cryptography is a package designed to expose cryptographic primitives and recipes to Python… | Upgrade cryptography 42.0.5 → ≥46.0.6 |
| python3-urllib3 2.2.2 → ≥2.7.0 · 2 (P2 2) | ||||
| CVE-2025-50182 | P2 | 5.3 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior… | Upgrade urllib3 2.2.2 → ≥2.5.0 |
| CVE-2026-44431 | P2 | 5.3 | urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin… | Upgrade urllib3 2.2.2 → ≥2.7.0 |
| expat 2.7.5 → >2.8.3 · also in boot.img, recovery.img · 1 (P1 1) | ||||
| CVE-2026-66046 | P1 | 7.5 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic… | Upgrade libexpat 2.7.5 → >2.8.3 |
| libpcre2 10.43 → >10.48_rc1 · 1 (P2 1) | ||||
| CVE-2026-89160 | P2 | 3.7 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF… | Upgrade pcre2 10.43 → ≥10.48 |
| mesa 24.0.7 → ≥25.3.6 · 1 (P1 1) | ||||
| CVE-2026-40393 | P1 | 8.1 | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU… | Upgrade mesa 24.0.7 → ≥25.3.6 |
| openssl 3.2.3 → ≥3.3.6 · also in boot.img, recovery.img · 1 (P1 1) | ||||
| CVE-2025-15467 | P1 | 8.8 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted… | Upgrade openssl 3.2.3 → ≥3.3.6 |
| python3-ply 3.11 → >3.11 · 1 (P0 1) | ||||
| CVE-2025-56005 | P0 | 9.8 | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote… | NVD confirms 3.11 (exact version / open range) but names no fixed release: find the upstr… |
| sqlite3 3.45.3 → ≥3.51.1 · also in boot.img, recovery.img · 1 (P1 1) | ||||
| CVE-2025-70873 | P1 | 7.5 | An information disclosure issue in the zipfileInflate function in the zipfile extension in… | Upgrade sqlite 3.45.3 → ≥3.51.1 |
| xz 5.4.6 → ≥5.8.3 · also in boot.img, recovery.img · 1 (P2 1) | ||||
| CVE-2026-34743 | P2 | 5.3 | XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to… | Upgrade xz 5.4.6 → ≥5.8.3 |
5 / 6 · U-Boot
U-Boot 2017.09: 29 CVEs need a fix; 11 ruled out on evidence from this build. Bootloader changes go last in the fix plan.
| CVE | Priority | CVSS | What it is | Fix |
|---|---|---|---|---|
| CVE-2018-18439 | P0 | 9.8 | DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-11059 | P0 | 9.8 | Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14192 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14193 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14194 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14195 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14196 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14198 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14199 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14200 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14201 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14202 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14203 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14204 | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2020-8432 | P0 | 9.8 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2022-30767 | P0 | 9.8 | nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14197 | P0 | 9.1 | An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2026-29009 | P1 | 8.2 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply()… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-42040 | P1 | 8.1 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2018-18440 | P1 | 7.8 | DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13104 | P1 | 7.8 | In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13106 | P1 | 7.8 | Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2021-27097 | P1 | 7.8 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2021-27138 | P1 | 7.8 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2025-24857 | P1 | 7.6 | Improper access control for volatile memory containing boot code in Universal Boot Loader… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13103 | P1 | 7.1 | A crafted self-referential DOS partition table will cause all Das U-Boot versions through… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2024-57256 | P1 | 7.1 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2024-57258 | P1 | 7.1 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-11690 | P2 | 5.9 | gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE | Ruling | Reason |
|---|---|---|
| CVE-2018-1000205 | not-built | fix touches common/image-sig.c not-built, tools/image-host.c host |
| CVE-2020-10648 | not-built | fix touches common/image-sig.c not-built |
| CVE-2022-2347 | not-built | fix touches drivers/usb/gadget/f_dfu.c not-built |
| CVE-2022-34835 | not-built | fix touches cmd/i2c.c not-built |
| CVE-2024-57254 | code-absent | no sqfs_inode_size anywhere in our U-Boot source |
| CVE-2024-57255 | code-absent | no sqfs_resolve_symlink anywhere in our U-Boot source |
| CVE-2024-57257 | code-absent | no sqfs_size anywhere in our U-Boot source |
| CVE-2024-57259 | code-absent | no sqfs_search_dir anywhere in our U-Boot source |
| CVE-2026-29007 | code-absent | no rmt_timestamp, rmt_win_scale, tcp_parse_options, tcp_rx_state_machine anywhere in our U-Boot source (net/tcp.c absent too) |
| CVE-2026-29008 | stored-judgement | integer underflow in tcp_rx_state_machine() (net/tcp.c); our 2017.09 U-Boot has no TCP stack (net/tcp.c absent, no CONFIG_PROT_TCP). The summary also names sto… |
| CVE-2026-46728 | not-built | fix touches common/image-sig.c not-built |
ledger
From the in-repo ledger docs/security/cve/rk: 3 fix record(s) merged here. Work on other branches is not shown.
Open in this image: 263 · open on the trunk: 263
| Record | Fixed by | Date | MR | CVEs fixed | In this image |
|---|---|---|---|---|---|
| rk-cve-fix-001 | wilber | 2026-10-06 | !359 | 38 | all |
| rk-cve-fix-002 | wilber | 2026-10-08 | !391 | 3 | all |
| rk-cve-fix-003 | wilber | 2026-10-11 | !425 | 3 | all |
| CVE | Fixed by | Date | Record | MR | Now |
|---|---|---|---|---|---|
| CVE-2026-10536 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11352 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11564 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11586 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11856 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-12064 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-13608 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-18924 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-19931 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-33416 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-33636 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-47162 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-4873 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-52859 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-5545 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-55999 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-56001 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-56002 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-56003 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-5773 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-6253 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-6276 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-6429 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-7009 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-7168 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-73078 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-80229 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80230 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80231 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80255 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-82208 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-82209 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8286 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8458 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8924 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8925 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8926 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8927 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8932 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9079 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9080 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9545 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9546 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9547 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
6 / 6 · Fix plan
One change per step, each built, bench-tested and revertable on its own. Start at the top.
| # | Fix and how | Closes | Risks | Rollback |
|---|---|---|---|---|
| 1 | Recommended · do first Bump 14 leaf packages, one commit each
| 78 userland rows |
| Delete that package's recipes-cve directory (or revert its commit); nothing else depends on the fork. |
| 2 | Recommended Backport the 71 kernel fixes that apply cleanly, as one series
| 71 kernel rows |
| Drop the series from the recipe; on a device, the A/B slot falls back after three failed boots. |
| 3 | Next Bump the 10 foundation packages, each on its own
| 34 userland rows |
| Revert that package's commit; the rest of the batch stays. |
| 4 | As time allows Hand-check the rest
| 61 rows |
| Each is its own commit. |
Every number on these pages comes from fixlist.json for the build and NVD snapshot named on page 1; re-run when either changes. Full list with each fix: fixlist.html.