1 / 6 · Summary
Need a fix: 7 · Fixed, version does not show it: 0 · No official patch: 0 · Upstream: not affected: 168 · Out of scope (not CRITICAL): 235
| Build | cve-scan-fb9afa43 |
| BUILD_ID | 20261105T052616Z-cvescan-fb9afa4 |
| Manifest | lib32-optisigns-image-optistick-panthor-mesons7d-bm201-6.12-lib32-20261105052645.manifest |
| Source | main-amlinux @ fb9afa4 · run branch cve-scan/amlinux-20261105-1226 |
| Versions | kernel 6.12.38 · U-Boot 2023.01 · browser engine not found |
| NVD data | 2026-11-05 05:25 UTC · scanned 2026-11-05 05:46 UTC |
| Data version | nvd 2026-11-05T05:25 · cna b537cbcd · bulletin n/a (no vendor bulletin, CNA only) · rules e4ef4d69 |
| Vendor bulletins | no vendor bulletin: kernel fix mapping is CNA-only |
| Kernel "fixed in source" check | network-reachable CVEs only (run with --fixed-status for all) |
What to do: the ranked fix plan, with risks and rollback, is on page 6.
2 / 6 · Triage
Every CVE matched against this image lands in exactly one bucket, and the run refuses to finish if one falls through. The ruled-out CVEs split into not affected (the vulnerable code cannot run on this product) and risk accepted (the code is reachable, but a ruling judged the risk low). Exclusions come from the build itself: the shipped kernel .config, the objects the U-Boot build produced, the rootfs, and fixes already in our source.
| Bucket | CVEs | Evidence |
|---|---|---|
| Need a fix | 7 | CRITICAL; an official patch exists and is not applied yet |
| Fixed, version does not show it | 0 | CRITICAL; the image carries a fix record's patch, the scan matches on the version alone |
| No official patch | 0 | CRITICAL; no fixing commit (kernel) or fixed release (userland) on record; re-judged every scan |
| Upstream: not affected, still matched | 0 | CRITICAL; upstream or Yocto says disputed / not affected, or ruled out at scan; 168 more ruled out at scan, counted under Ruled out |
| Out of scope (not CRITICAL) | 235 | below CRITICAL and still matched; not fixed by this skill, never in the numbers above |
| Unconfirmed: NVD gives no version | 23 | only unversioned NVD rows match; re-judged every scan, never in a fix module |
| Already fixed | 243 | SBOM patches 152 · recipe patches 84 · CVE_STATUS 4 · in source 3 |
| Ruled out — not affected | 1,501 | the vulnerable code cannot run on this product |
| Kernel: code not built | 1,452 | CONFIG off in the shipped .config, mapped through the kernel Makefiles; or another architecture |
| Kernel: no path from userspace | 2 | the subsystem is built but nothing in the rootfs can reach it |
| Kernel: other rulings | 7 | fix already in our kernel source, not our software, an NVD attribution error, code not in our kernel version, or a stored review ruling |
| U-Boot: code not in our bootloader | 1 | the fix touches code our U-Boot does not build or does not have |
| Userland: not ours / not our platform | 39 | NVD vendor-name collisions, other operating systems, other products |
| Ruled out — risk accepted by rule | 1,632 | reachable, but a standing ruling (local or physical access only) judged the risk low |
| Kernel: local access only | 1,427 | NVD attack vector LOCAL or PHYSICAL; the product has no root login |
| Userland: local access only | 205 | needs an attacker already on the device; low risk by ruling |
| Browser engine, grouped | 0 | Chromium build not found: not matched |
| CVE | Priority | CVSS | Component | Why unconfirmed |
|---|---|---|---|---|
| CVE-2026-4424 | P1 | 7.5 | libarchive 3.6.2 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.6.2 |
| CVE-2026-2369 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2436 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-4426 | P2 | 6.5 | libarchive 3.6.2 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.6.2 |
| CVE-2026-66337 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-66339 | P2 | 6.5 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-5119 | P2 | 5.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1467 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1536 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1539 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3099 | P2 | 5.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-66338 | P2 | 5.4 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-1801 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2443 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-2708 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-4271 | P2 | 5.3 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-12549 | P2 | 4.8 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-12891 | P2 | 4.3 | gstreamer 1.20.7 | NVD lists gstreamer with no version ("-") only: unanalysed, not confirmed for 1.20.7 |
| CVE-2026-12548 | P2 | 4.2 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3632 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3633 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3634 | P2 | 3.9 | libsoup 2.74.2 | NVD lists libsoup with no version ("-") only: unanalysed, not confirmed for 2.74.2 |
| CVE-2026-3184 | P2 | 3.7 | util-linux 2.37.4 | NVD lists util-linux with no version ("-") only: unanalysed, not confirmed for 2.37.4 |
gstreamer1.0-plugins-good 21, expat-native 18, unzip 14, libxml2-native 13, gstreamer1.0-plugins-bad 7, gstreamer1.0-plugins-base 7, glib-2.0-native 7, rsync-native 4, cups 4, cairo 4 · +30 more
not found: the Electron 43.0.0 runtime (meta-optisigns-poky-common/recipes-optisigns/optisigns-osui-runtime/optisigns-osui-runtime_43.0.0.bb) does not state its Chromium build, so the browser engine is not matched against NVD
3 / 6 · Kernel
Kernel 6.12.38: 92 CVEs still matched and not fixed (every bucket), by area.
5 P0 items, highest CVSS first.
| CVE | Area | What it is | CVSS |
|---|---|---|---|
| CVE-2026-63808 | EXFAT_FS | exfat: fix potential use-after-free in exfat_find_dir_entry() | 9.8 |
| CVE-2026-63912 | INET_ESP | xfrm: esp: restore combined single-frag length gate | 9.8 |
| CVE-2026-63922 | IPV6 | ipv6: exthdrs: refresh nh after handling HAO option | 9.8 |
| CVE-2026-63924 | IPV6 | ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() | 9.8 |
| CVE-2026-63830 | NET | net: skmsg: preserve sg.copy across SG transforms | 9.4 |
| CVE | Priority | CVSS | Area | What it is | Fix |
|---|---|---|---|---|---|
| Other drivers and core · 34 (P0 2 · P1 29 · P2 3) | |||||
| CVE-2026-63808 | P0 | 9.8 | EXFAT_FS | exfat: fix potential use-after-free in exfat_find_dir_entry() | applies cleanlyBackport upstream commit 3f5f8ee9917c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63912 | P0 | 9.8 | INET_ESP | xfrm: esp: restore combined single-frag length gate | applies cleanlyBackport upstream commit dfa0d7b0ff1e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38495 Out of scope (not CRITICAL) | P1 | 8.8 | HID | HID: core: ensure the allocated report buffer can contain the | applies cleanlyBackport upstream commit 4f15ee98304b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-39806 Out of scope (not CRITICAL) | P1 | 8.8 | HID_MULTITOUCH | HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() | applies cleanlyBackport upstream commit 0379eb8691b9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31450 Out of scope (not CRITICAL) | P1 | 8.8 | EXT4_FS | ext4: publish jinode after initialization | needs reworkBackport upstream commit 1aec30021edd — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31570 Out of scope (not CRITICAL) | P1 | 8.8 | CAN_GW | can: gw: fix OOB heap access in cgw_csum_crc8_rel() | applies cleanlyBackport upstream commit b9c310d72783 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31629 Out of scope (not CRITICAL) | P1 | 8.8 | NFC | nfc: llcp: add missing return after LLCP_CLOSED checks | applies cleanlyBackport upstream commit 2b5dd4632966 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43048 Out of scope (not CRITICAL) | P1 | 8.8 | HID | HID: core: Mitigate potential OOB by removing bogus memset() | applies cleanlyBackport upstream commit 0a3fe972a7cb (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63801 Out of scope (not CRITICAL) | P1 | 8.8 | TIPC_CRYPTO | tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done | applies cleanlyBackport upstream commit bda3348872a2 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63831 Out of scope (not CRITICAL) | P1 | 8.8 | MAC802154 | mac802154: llsec: add skb_cow_data() before in-place crypto | applies cleanlyBackport upstream commit 84a04eb5b210 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63916 Out of scope (not CRITICAL) | P1 | 8.8 | HID_WACOM | HID: wacom: Fix OOB write in wacom_hid_set_device_mode() | applies cleanlyBackport upstream commit c0a8899e02dd (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64010 Out of scope (not CRITICAL) | P1 | 8.8 | NFC | nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() | applies cleanlyBackport upstream commit b493ea2765cc (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64313 Out of scope (not CRITICAL) | P1 | 8.8 | CRYPTO_ECC | crypto: ecc - Fix carry overflow in vli multiplication | applies cleanlyBackport upstream commit 27b536a2ec8e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38574 Out of scope (not CRITICAL) | P1 | 8.6 | PPTP | pptp: ensure minimal skb length in pptp_xmit() | applies cleanlyBackport upstream commit de9c4861fb42 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-38608 Out of scope (not CRITICAL) | P1 | 8.6 | TLS | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | applies cleanlyBackport upstream commit 178f6a5c8cb3 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-68365 Out of scope (not CRITICAL) | P1 | 8.2 | NTFS3_FS | fs/ntfs3: Initialize allocated memory before use | needs reworkBackport upstream commit a8a3ca23bbd9 — needs rework (context drifted) -> stage the patch… |
| CVE-2025-71311 Out of scope (not CRITICAL) | P1 | 8.2 | NTFS3_FS | fs/ntfs3: Initialize new folios before use | applies cleanlyBackport upstream commit f223ebffa185 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43051 Out of scope (not CRITICAL) | P1 | 8.1 | HID_WACOM | HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq | applies cleanlyBackport upstream commit 2f1763f62909 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46232 Out of scope (not CRITICAL) | P1 | 8.1 | HID_PLAYSTATION | HID: playstation: Clamp num_touch_reports | applies cleanlyBackport upstream commit cac61b58a3b6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63925 Out of scope (not CRITICAL) | P1 | 8.1 | MACSEC | macsec: fix replay protection at XPN lower-PN wrap | applies cleanlyBackport upstream commit e68842b33564 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71131 Out of scope (not CRITICAL) | P1 | 7.5 | CRYPTO_SEQIV | crypto: seqiv - Do not use req->iv after crypto_aead_encrypt | applies cleanlyBackport upstream commit 50fdb78b7c0b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71161 Out of scope (not CRITICAL) | P1 | 7.5 | DM_VERITY | dm-verity: disable recursive forward error correction | needs reworkBackport upstream commit d9f3e47d3fae — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31467 Out of scope (not CRITICAL) | P1 | 7.5 | EROFS_FS_ZIP | erofs: add GFP_NOIO in the bio completion if needed | applies cleanlyBackport upstream commit c23df30915f8 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31662 Out of scope (not CRITICAL) | P1 | 7.5 | TIPC | tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG | applies cleanlyBackport upstream commit 48a5fe38772b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43245 Out of scope (not CRITICAL) | P1 | 7.5 | NTFS3_FS | ntfs: ->d_compare() must not block | needs reworkBackport upstream commit ca2a04e84af7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43336 Out of scope (not CRITICAL) | P1 | 7.5 | CRYPTO | lib/crypto: chacha: Zeroize permuted_state before it leaves scope | needs reworkBackport upstream commit e5046823f8fa — needs rework (context drifted) -> stage the patch… |
| CVE-2026-46102 Out of scope (not CRITICAL) | P1 | 7.5 | STREAM_PARSER | net: strparser: fix skb_head leak in strp_abort_strp() | applies cleanlyBackport upstream commit fe72340daaf1 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52974 Out of scope (not CRITICAL) | P1 | 7.5 | TLS | net: tls: fix strparser anchor skb leak on offload RX setup failure | applies cleanlyBackport upstream commit 58689498ca33 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64003 Out of scope (not CRITICAL) | P1 | 7.5 | SCSI | scsi: core: Run queues for all non-SDEV_DEL devices from | applies cleanlyBackport upstream commit 7205b5870227 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-71289 Out of scope (not CRITICAL) | P1 | 7.1 | NTFS3_FS | fs/ntfs3: handle attr_set_size() errors when truncating files | needs reworkBackport upstream commit 576248a34b92 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64452 Out of scope (not CRITICAL) | P1 | 7.1 | 6LOWPAN | 6lowpan: fix NHC entry use-after-free on error path | applies cleanlyBackport upstream commit 1720db928e5a (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2022-3523 Out of scope (not CRITICAL) | P2 | 5.3 | MMU | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2026-98097 Out of scope (not CRITICAL) | P2 | 5.3 | TIPC | tipc: Dont send random pad bytes in RESET/ACTIVATE messages | applies cleanlyBackport upstream commit 81c600c26302 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2022-3629 Out of scope (not CRITICAL) | P2 | 3.3 | VSOCKETS | A vulnerability was found in Linux Kernel. It has been declared as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Bluetooth · 28 (P1 26 · P2 2) | |||||
| CVE-2026-23395 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | needs reworkBackport upstream commit 5b3e2052334f — needs rework (context drifted) -> stage the patch… |
| CVE-2026-23461 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user | applies cleanlyBackport upstream commit 752a6c9596dd (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23462 Out of scope (not CRITICAL) | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: Fix possible UAF | applies cleanlyBackport upstream commit dbf666e4fc9b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31408 Out of scope (not CRITICAL) | P1 | 8.8 | BT_BREDR | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing | applies cleanlyBackport upstream commit 598dbba9919c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31773 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: SMP: derive legacy responder STK authentication from MITM | applies cleanlyBackport upstream commit 20756fec2f01 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43018 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in | applies cleanlyBackport upstream commit b255531b27da (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43334 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: SMP: force responder MITM requirements before building the | applies cleanlyBackport upstream commit d05111bfe37b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46056 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | applies cleanlyBackport upstream commit 85fa35120487 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52918 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: serialize accept_q access | applies cleanlyBackport upstream commit e83f5e24da74 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53071 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp | applies cleanlyBackport upstream commit 42776497cdbc (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53072 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER | applies cleanlyBackport upstream commit 5c7209a341ff (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53358 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: use chan timer to close channels in | needs reworkBackport upstream commit 8c8e620467a7 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-63944 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync | applies cleanlyBackport upstream commit bfea6091e0ff (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63946 Out of scope (not CRITICAL) | P1 | 8.8 | BT_LE | Bluetooth: ISO: fix UAF in iso_recv_frame | applies cleanlyBackport upstream commit 47f23a259517 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63947 Out of scope (not CRITICAL) | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: fix missing length checks in hidp_input_report() | applies cleanlyBackport upstream commit 2a3ac9ee11db (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63975 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp | applies cleanlyBackport upstream commit 41c2713b204e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64206 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock | needs reworkBackport upstream commit 2641a9e0a1dd — needs rework (context drifted) -> stage the patch… |
| CVE-2026-31393 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before | applies cleanlyBackport upstream commit dd815e6e3918 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31771 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: hci_event: move wake reason storage into validated event | needs reworkBackport upstream commit 2b2bf47cd755 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43134 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ | applies cleanlyBackport upstream commit 138d7eca445e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46138 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: hci_event: Fix OOB read and infinite loop in | applies cleanlyBackport upstream commit 5ddb80142611 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53254 Out of scope (not CRITICAL) | P1 | 8.1 | BT_RFCOMM | Bluetooth: RFCOMM: validate skb length in MCC handlers | applies cleanlyBackport upstream commit 23882b828c3c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53256 Out of scope (not CRITICAL) | P1 | 8.0 | BT_RFCOMM | Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() | applies cleanlyBackport upstream commit 43c441edacf9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53357 Out of scope (not CRITICAL) | P1 | 8.0 | BT | Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() | applies cleanlyBackport upstream commit ab1513597c6c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43062 Out of scope (not CRITICAL) | P1 | 7.1 | BT | Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() | applies cleanlyBackport upstream commit 15145675690c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64403 Out of scope (not CRITICAL) | P1 | 7.1 | BT | Bluetooth: L2CAP: validate option length before reading conf opt | applies cleanlyBackport upstream commit 687617555ced (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2022-42895 Out of scope (not CRITICAL) | P2 | 6.5 | BT | There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3619 Out of scope (not CRITICAL) | P2 | 3.5 | BT | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Network stack · 16 (P0 3 · P1 13) | |||||
| CVE-2026-63922 | P0 | 9.8 | IPV6 | ipv6: exthdrs: refresh nh after handling HAO option | applies cleanlyBackport upstream commit f7b52afe3592 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63924 | P0 | 9.8 | IPV6 | ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() | applies cleanlyBackport upstream commit d47548a36639 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63830 | P0 | 9.4 | NET | net: skmsg: preserve sg.copy across SG transforms | applies cleanlyBackport upstream commit 406e8a651a7b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63919 Out of scope (not CRITICAL) | P1 | 8.8 | XFRM | xfrm: input: hold netns during deferred transport reinjection | applies cleanlyBackport upstream commit c16f74dc1d75 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52920 Out of scope (not CRITICAL) | P1 | 8.3 | NETFILTER_XT_MATCH_POLICY | netfilter: xt_policy: fix strict mode inbound policy matching | applies cleanlyBackport upstream commit 4b2b4d7d4e20 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23456 Out of scope (not CRITICAL) | P1 | 8.2 | NF_CONNTRACK_H323 | netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case | applies cleanlyBackport upstream commit 1e3a3593162c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43233 Out of scope (not CRITICAL) | P1 | 8.2 | NF_CONNTRACK_H323 | netfilter: nf_conntrack_h323: fix OOB read in decode_choice() | applies cleanlyBackport upstream commit baed0d9ba91d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53268 Out of scope (not CRITICAL) | P1 | 8.2 | NF_CONNTRACK_IRC | netfilter: conntrack_irc: fix possible out-of-bounds read | applies cleanlyBackport upstream commit 66eba0ffce3b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-63913 Out of scope (not CRITICAL) | P1 | 8.2 | NF_CONNTRACK | netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST | applies cleanlyBackport upstream commit bed6e04be8e6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23003 Out of scope (not CRITICAL) | P1 | 7.5 | IPV6_TUNNEL | ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() | applies cleanlyBackport upstream commit 81c734dae203 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-23139 Out of scope (not CRITICAL) | P1 | 7.5 | NETFILTER_CONNCOUNT | netfilter: nf_conncount: update last_gc only when GC has been | needs reworkBackport upstream commit 7811ba452402 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-45859 Out of scope (not CRITICAL) | P1 | 7.5 | NETFILTER_NETLINK_QUEUE | netfilter: nfnetlink_queue: do shared-unconfirmed check before | needs reworkBackport upstream commit 207b3ebacb61 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-45860 Out of scope (not CRITICAL) | P1 | 7.5 | NETFILTER_CONNCOUNT | netfilter: nf_conncount: increase the connection clean up limit to 64 | needs reworkBackport upstream commit 21d033e47273 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-63968 Out of scope (not CRITICAL) | P1 | 7.5 | IPV6 | ipv6: fix possible infinite loop in fib6_select_path() | applies cleanlyBackport upstream commit 9c7da87c2dc8 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64414 Out of scope (not CRITICAL) | P1 | 7.5 | NF_DEFRAG_IPV6 | netfilter: handle unreadable frags | applies cleanlyBackport upstream commit da5b58478a9c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-98096 Out of scope (not CRITICAL) | P1 | 7.4 | IPV6 | ipv6: sr: restore network header before routing and forwarding | applies cleanlyBackport upstream commit 975b5b067f52 (applies cleanly) -> stage the patch in meta-optisi… |
| Unmapped (older advisories) · 12 (P1 7 · P2 5) | |||||
| CVE-2025-71072 Out of scope (not CRITICAL) | P1 | 8.2 | unmapped | shmem: fix recovery on rename failures | applies cleanlyBackport upstream commit e1b4c6a58304 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64368 Out of scope (not CRITICAL) | P1 | 8.1 | unmapped | mm/slab: do not limit zeroing to orig_size when only red zoning is | applies cleanlyBackport upstream commit 648927ceb840 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2020-1749 Out of scope (not CRITICAL) | P1 | 7.5 | unmapped | A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2020-25672 Out of scope (not CRITICAL) | P1 | 7.5 | unmapped | A memory leak vulnerability was found in Linux kernel in llcp_sock_connect | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2026-64374 Out of scope (not CRITICAL) | P1 | 7.5 | unmapped | sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT | applies cleanlyBackport upstream commit dd29c017aed6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2019-14899 Out of scope (not CRITICAL) | P1 | 7.4 | unmapped | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2008-4609 Out of scope (not CRITICAL) | P1 | 7.1 | unmapped | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-6240 Out of scope (not CRITICAL) | P2 | 6.5 | unmapped | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-2663 Out of scope (not CRITICAL) | P2 | 5.3 | unmapped | An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2010-4563 Out of scope (not CRITICAL) | P2 | 5.0 | unmapped | The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3567 Out of scope (not CRITICAL) | P2 | 4.6 | unmapped | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3630 Out of scope (not CRITICAL) | P2 | 3.1 | unmapped | A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Ethernet driver · 1 (P1 1) | |||||
| CVE-2026-53232 Out of scope (not CRITICAL) | P1 | 8.8 | PHYLIB | net: phy: clean the sfp upstream if phy probing fails | needs reworkBackport upstream commit 48774e87bbaa — needs rework (context drifted) -> stage the patch… |
| WiFi · 1 (P1 1) | |||||
| CVE-2026-63869 Out of scope (not CRITICAL) | P1 | 7.6 | MAC80211 | wifi: mac80211: limit injected antenna index in | applies cleanlyBackport upstream commit 6c0cf89f36ac (applies cleanly) -> stage the patch in meta-optisi… |
Patches go in meta-optisigns-poky4/recipes-cve/linux-meson/, one module per subsystem; kernel C patches are never shared across vendor trees.
4 / 6 · Userland
140 rows in 27 packages still matched and not fixed (every bucket). One version change per package closes its rows. The target is the lowest version that closes every row with a known affected range.
| Package | Now | Target | Rows | Where the change goes |
|---|---|---|---|---|
| ffmpeg-remux | 5.0.3 | ≥2025-01-13 | 31 | bump meta-optisigns-poky4/recipes-optisigns-common/ffmpeg-remux/ffmpeg-remux_5.0.3.bb |
| rsync | 2.6.9 | >3.5.1 | 15 | Amlogic only: copy the upstream recipe dir (kirkstone/meta-gplv2/recipes-devtools/rsync/, all its files) to meta-optisigns-poky4/recipes-cve/rsync/ as rsync_<new>.bb, pin PREFERRED_VERSION_rsync in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/rsync/rsync_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_rsync / _lib32-rsync at the old version and pins the new one as PREFERRED_VERSION_rsync:k6.12 + PREFERRED_VERSION_lib32-rsync:k6.12 (verify with bitbake-getvar in img_panthor) |
| bluez5 | 5.66 | ≥5.70 | 9 | bump meta-optisigns-poky4/recipes-connectivity/bluez5/bluez5_5.66.bb |
| expat | 2.2.9 | >2.9.0 | 9 | Amlogic only: copy the upstream recipe dir (kirkstone/meta-meson/recipes-core/expat/, all its files) to meta-optisigns-poky4/recipes-cve/expat/ as expat_<new>.bb, pin PREFERRED_VERSION_expat in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/expat/expat_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_expat / _lib32-expat at the old version and pins the new one as PREFERRED_VERSION_expat:k6.12 + PREFERRED_VERSION_lib32-expat:k6.12 (verify with bitbake-getvar in img_panthor) |
| cups | 2.4.2 | ≥2.4.20 | 8 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-extended/cups/, all its files) to meta-optisigns-poky4/recipes-cve/cups/ as cups_<new>.bb, pin PREFERRED_VERSION_cups in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/cups/cups_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_cups / _lib32-cups at the old version and pins the new one as PREFERRED_VERSION_cups:k6.12 + PREFERRED_VERSION_lib32-cups:k6.12 (verify with bitbake-getvar in img_panthor) |
| glib-2.0 | 2.72.3 | ≥2.88.1 | 8 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-core/glib-2.0/, all its files) to meta-optisigns-poky4/recipes-cve/glib-2.0/ as glib-2.0_<new>.bb, pin PREFERRED_VERSION_glib-2.0 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/glib-2.0/glib-2.0_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_glib-2.0 / _lib32-glib-2.0 at the old version and pins the new one as PREFERRED_VERSION_glib-2.0:k6.12 + PREFERRED_VERSION_lib32-glib-2.0:k6.12 (verify with bitbake-getvar in img_panthor) |
| glibc | 2.35 | — | 8 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-core/glibc/, all its files) to meta-optisigns-poky4/recipes-cve/glibc/ as glibc_<new>.bb, pin PREFERRED_VERSION_glibc in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/glibc/glibc_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_glibc / _lib32-glibc at the old version and pins the new one as PREFERRED_VERSION_glibc:k6.12 + PREFERRED_VERSION_lib32-glibc:k6.12 (verify with bitbake-getvar in img_panthor) |
| python3 | 3.10.18 | ≥3.14.7 | 8 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-devtools/python/, all its files) to meta-optisigns-poky4/recipes-cve/python3/ as python3_<new>.bb, pin PREFERRED_VERSION_python3 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/python3/python3_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_python3 / _lib32-python3 at the old version and pins the new one as PREFERRED_VERSION_python3:k6.12 + PREFERRED_VERSION_lib32-python3:k6.12 (verify with bitbake-getvar in img_panthor) |
| gstreamer1.0 | 1.20.7 | ≥1.28.1 | 6 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-multimedia/gstreamer/, all its files) to meta-optisigns-poky4/recipes-cve/gstreamer1.0/ as gstreamer1.0_<new>.bb, pin PREFERRED_VERSION_gstreamer1.0 in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/gstreamer1.0/gstreamer1.0_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_gstreamer1.0 / _lib32-gstreamer1.0 at the old version and pins the new one as PREFERRED_VERSION_gstreamer1.0:k6.12 + PREFERRED_VERSION_lib32-gstreamer1.0:k6.12 (verify with bitbake-getvar in img_panthor) |
| openssl | 3.0.21 | ≥3.0.23 | 6 | bump meta-optisigns-poky4/recipes-cve/openssl/openssl_3.0.21.bb |
| faad2 | 2.10.0 | >2.10.0 | 5 | no fixed upstream release (the fix is only after 2.10.0, which is current): carry patches in kirkstone/meta-meson/recipes-multimedia/faad2/faad2_2.10.0.bb |
| libpng | 1.6.39 | ≥1.6.56 | 5 | Amlogic only: copy the upstream recipe dir (kirkstone/poky/meta/recipes-multimedia/libpng/, all its files) to meta-optisigns-poky4/recipes-cve/libpng/ as libpng_<new>.bb, pin PREFERRED_VERSION_libpng in meta-optisigns-poky-common/conf/optisigns-pp-gen5.conf; the poky recipe stays for the other lines; CVE fixes target the panthor lane only (k6.12 override, set only by amlogic_k6.12.inc): poky4 is parsed by gen3/gen3-a64/gen5/gen5-a64/gen5w/panthor and optisigns-pp-gen5.conf by every gen5 lane. A patch on the current version goes in meta-optisigns-poky4/recipes-cve/libpng/libpng_%.bbappend as SRC_URI:append:k6.12, never SRC_URI +=; a bump keeps the base PREFERRED_VERSION_libpng / _lib32-libpng at the old version and pins the new one as PREFERRED_VERSION_libpng:k6.12 + PREFERRED_VERSION_lib32-libpng:k6.12 (verify with bitbake-getvar in img_panthor) |
12 rows have no affected range in NVD and need a manual check before acting.
| CVE | Priority | CVSS | What it is | Fix suggestion |
|---|---|---|---|---|
| ffmpeg-remux 5.0.3 → ≥2025-01-13 · 31 (P1 16 · P2 15) | ||||
| CVE-2025-25469 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the… | Upgrade ffmpeg 5.0.3 → ≥2025-01-13 |
| CVE-2026-30754 Out of scope (not CRITICAL) | P1 | 8.8 | A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In… | Upgrade ffmpeg 5.0.3 → ≥8.1 |
| CVE-2026-64830 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-64832 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-64835 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66036 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66039 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66040 Out of scope (not CRITICAL) | P1 | 8.8 | FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2022-48434 Out of scope (not CRITICAL) | P1 | 8.1 | libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves… | Upgrade ffmpeg 5.0.3 → ≥5.1.2 |
| CVE-2023-6603 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-30997 Out of scope (not CRITICAL) | P1 | 7.5 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-30998 Out of scope (not CRITICAL) | P1 | 7.5 | An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-30999 Out of scope (not CRITICAL) | P1 | 7.5 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers… | Upgrade ffmpeg 5.0.3 → >8.0.1 |
| CVE-2026-64834 Out of scope (not CRITICAL) | P1 | 7.5 | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2023-6605 Out of scope (not CRITICAL) | P1 | 7.2 | A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-64833 Out of scope (not CRITICAL) | P1 | 7.1 | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2025-25468 Out of scope (not CRITICAL) | P2 | 6.5 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the… | Upgrade ffmpeg 5.0.3 → ≥2025-01-13 |
| CVE-2026-107695 Out of scope (not CRITICAL) | P2 | 6.5 | FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| CVE-2026-107696 Out of scope (not CRITICAL) | P2 | 6.5 | FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in… | Upgrade ffmpeg 5.0.3 → >9.0.2 |
| CVE-2026-66037 Out of scope (not CRITICAL) | P2 | 6.5 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2026-66038 Out of scope (not CRITICAL) | P2 | 6.5 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure… | Upgrade ffmpeg 5.0.3 → >8.1.2 |
| CVE-2024-7272 Out of scope (not CRITICAL) | P2 | 6.3 | A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This… | Upgrade ffmpeg 5.0.3 → ≥5.1.6 |
| CVE-2025-1594 Out of scope (not CRITICAL) | P2 | 6.3 | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects… | Upgrade ffmpeg 5.0.3 → >7.1 |
| CVE-2026-107675 Out of scope (not CRITICAL) | P2 | 5.9 | FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… | Upgrade ffmpeg 5.0.3 → >9.0.2 |
| CVE-2026-107698 Out of scope (not CRITICAL) | P2 | 5.4 | FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery… | Upgrade ffmpeg 5.0.3 → ≥7.1.4 |
| CVE-2023-6602 Out of scope (not CRITICAL) | P2 | 5.3 | A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2023-6604 Out of scope (not CRITICAL) | P2 | 5.3 | A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2025-10256 Out of scope (not CRITICAL) | P2 | 5.3 | A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter… | Upgrade ffmpeg 5.0.3 → ≥8.0 |
| CVE-2026-107660 Out of scope (not CRITICAL) | P2 | 4.8 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| CVE-2023-6601 Out of scope (not CRITICAL) | P2 | 4.7 | A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file… | Upgrade ffmpeg 5.0.3 → >6.0 |
| CVE-2026-107697 Out of scope (not CRITICAL) | P2 | 4.3 | FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows… | Upgrade ffmpeg 5.0.3 → ≥8.1.3 |
| rsync 2.6.9 → >3.5.1 · 15 (P1 9 · P2 6) | ||||
| CVE-2026-43618 Out of scope (not CRITICAL) | P1 | 8.1 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-53789 Out of scope (not CRITICAL) | P1 | 8.1 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53795 Out of scope (not CRITICAL) | P1 | 8.1 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2014-2855 Out of scope (not CRITICAL) | P1 | 7.8 | The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers… | Upgrade rsync 2.6.9 → >3.1.0 |
| CVE-2008-1720 Out of scope (not CRITICAL) | P1 | 7.5 | Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled,… | NVD confirms 2.6.9 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2018-5764 Out of scope (not CRITICAL) | P1 | 7.5 | The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent… | Upgrade rsync 2.6.9 → ≥3.1.3 |
| CVE-2026-119741 Out of scope (not CRITICAL) | P1 | 7.5 | rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's… | Upgrade rsync 2.6.9 → >3.5.1 |
| CVE-2026-70464 Out of scope (not CRITICAL) | P1 | 7.5 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2022-29154 Out of scope (not CRITICAL) | P1 | 7.4 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write… | Upgrade rsync 2.6.9 → ≥3.2.5 |
| CVE-2026-43620 Out of scope (not CRITICAL) | P2 | 6.5 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-53786 Out of scope (not CRITICAL) | P2 | 6.5 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53801 Out of scope (not CRITICAL) | P2 | 5.9 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-53798 Out of scope (not CRITICAL) | P2 | 5.3 | rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… | Upgrade rsync 2.6.9 → ≥3.5.0 |
| CVE-2026-43617 Out of scope (not CRITICAL) | P2 | 4.8 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… | Upgrade rsync 2.6.9 → >3.4.2 |
| CVE-2026-45232 Out of scope (not CRITICAL) | P2 | 3.1 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in… | Upgrade rsync 2.6.9 → ≥3.4.3 |
| bluez5 5.66 → ≥5.70 · 9 (P1 5 · P2 4) | ||||
| CVE-2023-27349 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-44431 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-50229 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-50230 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-51596 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51580 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51589 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51592 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51594 Out of scope (not CRITICAL) | P2 | 2.6 | BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| expat 2.2.9 → >2.9.0 · 9 (P1 8 · P2 1) | ||||
| CVE-2026-118370 Out of scope (not CRITICAL) | P1 | 8.2 | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in… | Upgrade libexpat 2.2.9 → >2.9.0 |
| CVE-2023-52425 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full… | Upgrade libexpat 2.2.9 → >2.5.0 |
| CVE-2024-28757 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of… | Upgrade libexpat 2.2.9 → ≥2.6.2 |
| CVE-2024-45490 Out of scope (not CRITICAL) | P1 | 7.5 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length… | Upgrade libexpat 2.2.9 → ≥2.6.3 |
| CVE-2025-59375 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations… | Upgrade libexpat 2.2.9 → ≥2.7.2 |
| CVE-2026-115506 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs… | Upgrade libexpat 2.2.9 → >2.9.0 |
| CVE-2026-117610 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in… | Upgrade libexpat 2.2.9 → >2.9.0 |
| CVE-2026-66046 Out of scope (not CRITICAL) | P1 | 7.5 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic… | Upgrade libexpat 2.2.9 → >2.8.3 |
| CVE-2024-50602 Out of scope (not CRITICAL) | P2 | 5.9 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser… | Upgrade libexpat 2.2.9 → ≥2.6.4 |
| cups 2.4.2 → ≥2.4.20 · 8 (P1 1 · P2 7) | ||||
| CVE-2026-34980 Out of scope (not CRITICAL) | P1 | 7.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2025-58364 Out of scope (not CRITICAL) | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → ≥2.4.13 |
| CVE-2026-107886 Out of scope (not CRITICAL) | P2 | 6.5 | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When… | Upgrade cups 2.4.2 → ≥2.4.20 |
| CVE-2026-34978 Out of scope (not CRITICAL) | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2026-41079 Out of scope (not CRITICAL) | P2 | 5.4 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → ≥2.4.17 |
| CVE-2026-34979 Out of scope (not CRITICAL) | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| CVE-2026-61702 Out of scope (not CRITICAL) | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → ≥2.4.20 |
| CVE-2026-27447 Out of scope (not CRITICAL) | P2 | 4.8 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.2 → >2.4.16 |
| glib-2.0 2.72.3 → ≥2.88.1 · 8 (P1 7 · P2 1) | ||||
| CVE-2026-58014 Out of scope (not CRITICAL) | P1 | 8.6 | A flaw was found in GLib. An off-by-one error can occur in the… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2026-58010 Out of scope (not CRITICAL) | P1 | 8.2 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58012 Out of scope (not CRITICAL) | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58013 Out of scope (not CRITICAL) | P1 | 8.2 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2025-4056 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application… | Upgrade glib 2.72.3 → ≥2.84.1 |
| CVE-2026-58011 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the… | Upgrade glib 2.72.3 → ≥2.86.5 |
| CVE-2026-58015 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL… | Upgrade glib 2.72.3 → ≥2.88.1 |
| CVE-2025-14512 Out of scope (not CRITICAL) | P2 | 6.5 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and… | Upgrade glib 2.72.3 → ≥2.86.3 |
| glibc 2.35 → no fixed release · 8 (P1 6 · P2 2) | ||||
| CVE-2025-15281 Out of scope (not CRITICAL) | P1 | 7.5 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version… | Upgrade glibc 2.35 → ≥2.43 |
| CVE-2026-0915 Out of scope (not CRITICAL) | P1 | 7.5 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.42 |
| CVE-2026-4046 Out of scope (not CRITICAL) | P1 | 7.5 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-4437 Out of scope (not CRITICAL) | P1 | 7.5 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-5928 Out of scope (not CRITICAL) | P1 | 7.5 | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set… | Upgrade glibc 2.35 → >2.43 |
| CVE-2026-5435 Out of scope (not CRITICAL) | P1 | 7.3 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version… | NVD confirms 2.35 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2026-6238 Out of scope (not CRITICAL) | P2 | 6.5 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version… | NVD confirms 2.35 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2026-4438 Out of scope (not CRITICAL) | P2 | 5.4 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the… | Upgrade glibc 2.35 → >2.43 |
| python3 3.10.18 → ≥3.14.7 · 8 (P1 5 · P2 3) | ||||
| CVE-2025-13836 Out of scope (not CRITICAL) | P1 | 7.5 | When reading an HTTP response from a server, if no read amount is specified, the default… | Upgrade python 3.10.18 → ≥3.10.20 |
| CVE-2026-15308 Out of scope (not CRITICAL) | P1 | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through… | Upgrade python 3.10.18 → ≥3.10.21 |
| CVE-2026-3087 Out of scope (not CRITICAL) | P1 | 7.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a… | Upgrade python 3.10.18 → >3.14.4 |
| CVE-2026-3644 Out of scope (not CRITICAL) | P1 | 7.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… | Upgrade python 3.10.18 → ≥3.13.13 |
| CVE-2026-7210 Out of scope (not CRITICAL) | P1 | 7.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat… | Upgrade python 3.10.18 → ≥3.13.14 |
| CVE-2026-6019 Out of scope (not CRITICAL) | P2 | 6.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for… | Upgrade python 3.10.18 → ≥3.13.14 |
| CVE-2025-12084 Out of scope (not CRITICAL) | P2 | 5.3 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a… | Upgrade python 3.10.18 → ≥3.13.11 |
| CVE-2025-12781 Out of scope (not CRITICAL) | P2 | 5.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions… | Upgrade python 3.10.18 → ≥3.13.10 |
| gstreamer1.0 1.20.7 → ≥1.28.1 · 6 (P1 4 · P2 2) | ||||
| CVE-2025-3887 Out of scope (not CRITICAL) | P1 | 8.8 | GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | Upgrade gstreamer 1.20.7 → ≥1.26.1 |
| CVE-2026-3083 Out of scope (not CRITICAL) | P1 | 8.8 | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.20.7 → ≥1.28.1 |
| CVE-2026-3085 Out of scope (not CRITICAL) | P1 | 8.8 | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.20.7 → ≥1.28.1 |
| CVE-2025-47219 Out of scope (not CRITICAL) | P1 | 8.1 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| CVE-2025-47806 Out of scope (not CRITICAL) | P2 | 5.6 | In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| CVE-2025-47808 Out of scope (not CRITICAL) | P2 | 5.6 | In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may… | Upgrade gstreamer 1.20.7 → ≥1.26.2 |
| openssl 3.0.21 → ≥3.0.23 · 6 (P1 1 · P2 5) | ||||
| CVE-2026-84782 Out of scope (not CRITICAL) | P1 | 8.2 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-35189 Out of scope (not CRITICAL) | P2 | 5.3 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-75805 Out of scope (not CRITICAL) | P2 | 5.3 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-75806 Out of scope (not CRITICAL) | P2 | 5.3 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-54872 Out of scope (not CRITICAL) | P2 | 3.7 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| CVE-2026-77696 Out of scope (not CRITICAL) | P2 | 3.7 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values,… | Upgrade openssl 3.0.21 → ≥3.0.23 |
| faad2 2.10.0 → >2.10.0 · 5 (P1 4 · P2 1) | ||||
| CVE-2021-32273 Out of scope (not CRITICAL) | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32274 Out of scope (not CRITICAL) | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32277 Out of scope (not CRITICAL) | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32278 Out of scope (not CRITICAL) | P1 | 7.8 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function… | Upgrade faad2 2.10.0 → >2.10.0 |
| CVE-2021-32276 Out of scope (not CRITICAL) | P2 | 5.5 | An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the… | Upgrade faad2 2.10.0 → >2.10.0 |
| libpng 1.6.39 → ≥1.6.56 · 5 (P1 5) | ||||
| CVE-2026-25646 Out of scope (not CRITICAL) | P1 | 8.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.55 |
| CVE-2026-33636 Out of scope (not CRITICAL) | P1 | 7.6 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.56 |
| CVE-2026-33416 Out of scope (not CRITICAL) | P1 | 7.5 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.56 |
| CVE-2025-64720 Out of scope (not CRITICAL) | P1 | 7.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.51 |
| CVE-2025-66293 Out of scope (not CRITICAL) | P1 | 7.1 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG… | Upgrade libpng 1.6.39 → ≥1.6.52 |
| libsoup-2.4 2.74.2 → ≥3.7.3 · 5 (P1 5) | ||||
| CVE-2026-102556 Out of scope (not CRITICAL) | P1 | 8.6 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame,… | Upgrade libsoup 2.74.2 → ≥3.7.3 |
| CVE-2026-102557 Out of scope (not CRITICAL) | P1 | 8.6 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a… | Upgrade libsoup 2.74.2 → ≥3.7.3 |
| CVE-2026-102558 Out of scope (not CRITICAL) | P1 | 8.6 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0),… | Upgrade libsoup 2.74.2 → ≥3.7.3 |
| CVE-2026-102559 Out of scope (not CRITICAL) | P1 | 8.6 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very… | Upgrade libsoup 2.74.2 → ≥3.7.3 |
| CVE-2026-102555 Out of scope (not CRITICAL) | P1 | 8.2 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated… | Upgrade libsoup 2.74.2 → ≥3.7.3 |
| gawk 3.1.5 → >5.4.0 · 2 (P1 2) | ||||
| CVE-2026-40467 Out of scope (not CRITICAL) | P1 | 7.5 | Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir()… | Upgrade gawk 3.1.5 → >5.4.0 |
| CVE-2026-40553 Out of scope (not CRITICAL) | P1 | 7.5 | Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk… | Upgrade gawk 3.1.5 → >5.4.0 |
| libsndfile1 1.0.31 → >1.2.2 · 2 (P1 1 · P2 1) | ||||
| CVE-2025-52194 Out of scope (not CRITICAL) | P1 | 7.5 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier… | Upgrade libsndfile 1.0.31 → >1.2.2 |
| CVE-2024-50613 Out of scope (not CRITICAL) | P2 | 6.5 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in… | Upgrade libsndfile 1.0.31 → >1.2.2 |
| sqlite3 3.38.5 → ≥3.51.1 · 2 (P1 2) | ||||
| CVE-2025-6965 Out of scope (not CRITICAL) | P1 | 7.7 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate… | Upgrade sqlite 3.38.5 → ≥3.50.2 |
| CVE-2025-70873 Out of scope (not CRITICAL) | P1 | 7.5 | An information disclosure issue in the zipfileInflate function in the zipfile extension in… | Upgrade sqlite 3.38.5 → ≥3.51.1 |
| boost 1.78.0 → no fixed release · 1 (P2 1) | ||||
| CVE-2009-3654 Out of scope (not CRITICAL) | P2 | 6.4 | Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote… | Upgrade boost 1.78.0 → >6.x-1.01 |
| busybox 1.35.0 → >1.37.0 · 1 (P2 1) | ||||
| CVE-2025-60876 Out of scope (not CRITICAL) | P2 | 6.5 | BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the… | Upgrade busybox 1.35.0 → >1.37.0 |
| coreutils 6.9 → ≥8.23 · 1 (P1 1) | ||||
| CVE-2014-9471 Out of scope (not CRITICAL) | P1 | 7.5 | The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of… | Upgrade coreutils 6.9 → ≥8.23 |
| gdk-pixbuf 2.42.10 → ≥2.44.6 · 1 (P1 1) | ||||
| CVE-2026-5201 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability… | Upgrade gdk-pixbuf 2.42.10 → ≥2.44.6 |
| harfbuzz 4.0.1 → ≥12.3.0 · 1 (P2 1) | ||||
| CVE-2026-22693 Out of scope (not CRITICAL) | P2 | 5.3 | HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference… | Upgrade harfbuzz 4.0.1 → ≥12.3.0 |
| libgcc 11.5.0 → ≥2023-09-12 · 1 (P2 1) | ||||
| CVE-2023-4039 Out of scope (not CRITICAL) | P2 | 4.8 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target… | Upgrade gcc 11.5.0 → ≥2023-09-12 |
| mesa 24.1.7 → ≥25.3.6 · 1 (P0 1) | ||||
| CVE-2026-40393 | P0 | 9.8 | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU… | Upgrade mesa 24.1.7 → ≥25.3.6 |
| ncurses 6.3+20220423 → >6.3 · 1 (P1 1) | ||||
| CVE-2022-29458 Out of scope (not CRITICAL) | P1 | 7.1 | ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in… | NVD confirms 6.3+20220423 (exact version / open range) but names no fixed release: find t… |
| speex 1.2.0 → >1.2 · 1 (P2 1) | ||||
| CVE-2020-23904 Out of scope (not CRITICAL) | P2 | 5.5 | A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of… | NVD confirms 1.2.0 (exact version / open range) but names no fixed release: find the upst… |
| wpa-supplicant 2.10 → >2.10 · 1 (P2 1) | ||||
| CVE-2023-52160 Out of scope (not CRITICAL) | P2 | 6.5 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a… | Upgrade wpa_supplicant 2.10 → >2.10 |
| xz 5.2.6 → ≥5.8.3 · 1 (P2 1) | ||||
| CVE-2026-34743 Out of scope (not CRITICAL) | P2 | 5.3 | XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to… | Upgrade xz 5.2.6 → ≥5.8.3 |
5 / 6 · U-Boot
U-Boot 2023.01: 10 CVEs still matched and not fixed (every bucket); 1 ruled out on evidence from this build. Bootloader changes go last in the fix plan.
| CVE | Priority | CVSS | What it is | Fix |
|---|---|---|---|---|
| CVE-2026-29009 | P0 | 9.8 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply()… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2026-46728 Out of scope (not CRITICAL) | P1 | 8.8 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-42040 Out of scope (not CRITICAL) | P1 | 8.1 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57254 Out of scope (not CRITICAL) | P1 | 7.1 | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57255 Out of scope (not CRITICAL) | P1 | 7.1 | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57256 Out of scope (not CRITICAL) | P1 | 7.1 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57258 Out of scope (not CRITICAL) | P1 | 7.1 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57259 Out of scope (not CRITICAL) | P1 | 7.1 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2026-29007 Out of scope (not CRITICAL) | P2 | 5.3 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2024-57257 Out of scope (not CRITICAL) | P2 | 2.0 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE | Ruling | Reason |
|---|---|---|
| CVE-2026-29008 | stored-judgement | integer underflow in tcp_rx_state_machine() (net/tcp.c); our 2023.01 U-Boot has no TCP stack (net/tcp.c absent, no CONFIG_PROT_TCP). The summary also names sto… |
ledger
From the in-repo ledger docs/security/cve/amlinux: 13 fix record(s) merged here. Work on other branches is not shown.
Need a fix: 7 · Fixed, version does not show it: 0 · No official patch: 0 · Upstream: not affected: 168 · Out of scope (not CRITICAL): 235
| Record | Fixed by | Date | MR | CVEs fixed | In this image |
|---|---|---|---|---|---|
| amlinux-cve-fix-001 | wilber | 2026-10-14 | !465 | 13 | all |
| amlinux-cve-fix-002 | wilber | 2026-10-14 | !465 | 5 | all |
| amlinux-cve-fix-003 | wilber | 2026-10-14 | !465 | 2 | all |
| amlinux-cve-fix-004 | wilber | 2026-10-15 | !482 | 29 | all |
| amlinux-cve-fix-005 | wilber | 2026-10-15 | !482 | 11 | all |
| amlinux-cve-fix-006 | wilber | 2026-10-18 | !541 | 4 | all |
| amlinux-cve-fix-007 | wilber | 2026-10-18 | !541 | 18 | all |
| amlinux-cve-fix-008 | wilber | 2026-10-18 | !541 | 3 | all |
| amlinux-cve-fix-009 | wilber | 2026-10-18 | !541 | 1 | all |
| amlinux-cve-fix-010 | wilber | 2026-10-18 | !541 | 7 | all |
| amlinux-cve-fix-011 | wilber | 2026-10-23 | !639 | 2 | all |
| amlinux-cve-fix-012 | wilber | 2026-10-23 | !639 | 1 | all |
| amlinux-cve-fix-013 | wilber | 2026-10-23 | !639 | 1 | all |
| CVE | Fixed by | Date | Record | MR | Now |
|---|---|---|---|---|---|
| CVE-2024-45491 | wilber | 2026-10-14 | amlinux-cve-fix-003 | !465 | fixed |
| CVE-2024-45492 | wilber | 2026-10-14 | amlinux-cve-fix-003 | !465 | fixed |
| CVE-2025-14087 | wilber | 2026-10-23 | amlinux-cve-fix-011 | !639 | fixed |
| CVE-2025-38472 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2025-38512 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-38643 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-39770 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2025-39849 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-39864 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2025-39946 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2025-6021 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2025-71080 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2025-71127 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-0989 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-0990 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-102560 | wilber | 2026-10-23 | amlinux-cve-fix-013 | !639 | fixed |
| CVE-2026-13608 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-18924 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-19931 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-23240 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-23246 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-23455 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-31414 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-31448 | wilber | 2026-10-18 | amlinux-cve-fix-008 | !541 | fixed |
| CVE-2026-31533 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-31682 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-43037 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-43038 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43071 | wilber | 2026-10-18 | amlinux-cve-fix-009 | !541 | fixed |
| CVE-2026-43083 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43099 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43101 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43139 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43186 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43194 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43197 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-43198 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43341 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43452 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-43501 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46037 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46115 | wilber | 2026-10-18 | amlinux-cve-fix-008 | !541 | fixed |
| CVE-2026-46125 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46152 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46166 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-46244 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46266 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-46289 | wilber | 2026-10-18 | amlinux-cve-fix-008 | !541 | fixed |
| CVE-2026-46306 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52945 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52946 | wilber | 2026-10-18 | amlinux-cve-fix-006 | !541 | fixed |
| CVE-2026-52981 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-52982 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-52993 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-53002 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-53006 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53069 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53131 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-53184 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53221 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-53228 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-53235 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53275 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-53384 | wilber | 2026-10-18 | amlinux-cve-fix-006 | !541 | fixed |
| CVE-2026-5450 | wilber | 2026-10-23 | amlinux-cve-fix-012 | !639 | fixed |
| CVE-2026-54874 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-58016 | wilber | 2026-10-23 | amlinux-cve-fix-011 | !639 | fixed |
| CVE-2026-63072 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63074 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63076 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-63795 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-63992 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-63994 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64024 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64025 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-64046 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-64047 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-64061 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64066 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64067 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64068 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64116 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64132 | wilber | 2026-10-15 | amlinux-cve-fix-004 | !482 | fixed |
| CVE-2026-64160 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64216 | wilber | 2026-10-18 | amlinux-cve-fix-010 | !541 | fixed |
| CVE-2026-64223 | wilber | 2026-10-15 | amlinux-cve-fix-005 | !482 | fixed |
| CVE-2026-64355 | wilber | 2026-10-18 | amlinux-cve-fix-006 | !541 | fixed |
| CVE-2026-64435 | wilber | 2026-10-18 | amlinux-cve-fix-006 | !541 | fixed |
| CVE-2026-64450 | wilber | 2026-10-18 | amlinux-cve-fix-007 | !541 | fixed |
| CVE-2026-6653 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-75803 | wilber | 2026-10-14 | amlinux-cve-fix-002 | !465 | fixed |
| CVE-2026-80229 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80230 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80231 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-80255 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-82208 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
| CVE-2026-82209 | wilber | 2026-10-14 | amlinux-cve-fix-001 | !465 | fixed |
6 / 6 · Fix plan
One change per step, each built, bench-tested and revertable on its own. Start at the top.
| # | Fix and how | Closes | Risks | Rollback |
|---|---|---|---|---|
| 1 | Recommended · do first Patch 13 leaf packages, one commit each
| 83 userland rows |
| Revert that package's commit; nothing else depends on it. |
| 2 | Recommended Backport the 65 kernel fixes that apply cleanly, one module per subsystem
| 65 kernel rows |
| Revert the module's commit (each subsystem is its own); on a device, the A/B slot falls back after three failed boots. |
| 3 | Next Patch the 8 foundation packages, each on its own
| 40 userland rows |
| Revert that package's commit; the rest of the batch stays. |
| 4 | As time allows Hand-check the rest
| 47 rows |
| Each is its own commit. |
| 5 | Last Fix U-Boot 2023.01, last (locked)
| 10 U-Boot rows |
| Revert that area's module commit (each is its own commit) and reflash the previous loader through the bench rails. |
Every number on these pages comes from fixlist.json for the build and NVD snapshot named on page 1; re-run when either changes. Full list with each fix: fixlist.html.