1 / 6 · Summary
Need a fix: 0 · Fixed, version does not show it: 18 · No official patch: 2 · Upstream: not affected: 222 · Out of scope (not CRITICAL): 205
| Build | cve-scan-2cc47580 · board proplayer-gen5 |
| BUILD_ID | 20261105T045944Z-cve107950919-2cc47580a |
| Manifest | core-image-weston-gaidatech-evb-giada-dn84-20261105050008.manifest |
| Also scanned | boot.img: core-image-rk3576-ab-initramfs-gaidatech-evb-giada-dn84-20261105050008.manifest · recovery.img: core-image-rk3576-recovery-initramfs-gaidatech-evb-giada-dn84-20261105050008.manifest |
| Source | develop-rockchip @ 2cc47580 · run branch cve-scan/rk-20261105-1159 |
| Versions | kernel 6.1.99 · U-Boot 2017.09 · browser engine not found |
| NVD data | 2026-11-05 04:59 UTC · scanned 2026-11-05 05:18 UTC |
| Data version | nvd 2026-11-05T04:59 · cna b537cbcd · bulletin rockchip 26a75f8d · rules e4ef4d69 |
| Vendor bulletins | 4,674 CVEs |
| Kernel "fixed in source" check | network-reachable CVEs only (run with --fixed-status for all) |
What to do: the ranked fix plan, with risks and rollback, is on page 6.
2 / 6 · Triage
Every CVE matched against this image lands in exactly one bucket, and the run refuses to finish if one falls through. The ruled-out CVEs split into not affected (the vulnerable code cannot run on this product) and risk accepted (the code is reachable, but a ruling judged the risk low). Exclusions come from the build itself: the shipped kernel .config, the objects the U-Boot build produced, the rootfs, and fixes already in our source.
| Bucket | CVEs | Evidence |
|---|---|---|
| Need a fix | 0 | CRITICAL; an official patch exists and is not applied yet |
| Fixed, version does not show it | 18 | CRITICAL; the image carries a fix record's patch, the scan matches on the version alone |
| No official patch | 2 | CRITICAL; no fixing commit (kernel) or fixed release (userland) on record; re-judged every scan |
| Upstream: not affected, still matched | 1 | CRITICAL; upstream or Yocto says disputed / not affected, or ruled out at scan; 221 more ruled out at scan, counted under Ruled out |
| Out of scope (not CRITICAL) | 205 | below CRITICAL and still matched; not fixed by this skill, never in the numbers above |
| Unconfirmed: NVD gives no version | 12 | only unversioned NVD rows match; re-judged every scan, never in a fix module |
| Already fixed | 233 | recipe patches 181 · CVE_STATUS 24 · SBOM patches 23 · in source 5 |
| Ruled out — not affected | 2,469 | the vulnerable code cannot run on this product |
| Kernel: code not built | 2,380 | CONFIG off in the shipped .config, mapped through the kernel Makefiles; or another architecture |
| Kernel: no path from userspace | 43 | the subsystem is built but nothing in the rootfs can reach it |
| Kernel: other rulings | 16 | fix already in our kernel source, not our software, an NVD attribution error, code not in our kernel version, or a stored review ruling |
| U-Boot: code not in our bootloader | 11 | the fix touches code our U-Boot does not build or does not have |
| Userland: not ours / not our platform | 19 | NVD vendor-name collisions, other operating systems, other products |
| Ruled out — risk accepted by rule | 2,118 | reachable, but a standing ruling (local or physical access only) judged the risk low |
| Kernel: local access only | 1,929 | NVD attack vector LOCAL or PHYSICAL; the product has no root login |
| Userland: local access only | 189 | needs an attacker already on the device; low risk by ruling |
| Browser engine, grouped | 0 | Chromium build not found: not matched |
| CVE | Priority | CVSS | Component | Why unconfirmed |
|---|---|---|---|---|
| CVE-2026-42010 | P0 | 9.8 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-33845 | P0 | 9.1 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-1584 | P1 | 7.5 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-42009 | P1 | 7.5 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2026-4424 | P1 | 7.5 | libarchive 3.7.9 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.7.9 |
| CVE-2026-3833 | P1 | 7.4 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
| CVE-2023-39329 | P2 | 6.5 | openjpeg 2.5.3 | NVD lists openjpeg with no version ("-") only: unanalysed, not confirmed for 2.5.3 |
| CVE-2026-4426 | P2 | 6.5 | libarchive 3.7.9 | NVD lists libarchive with no version ("-") only: unanalysed, not confirmed for 3.7.9 |
| CVE-2023-39327 | P2 | 4.3 | openjpeg 2.5.3 | NVD lists openjpeg with no version ("-") only: unanalysed, not confirmed for 2.5.3 |
| CVE-2026-12891 | P2 | 4.3 | gstreamer 1.22.12 | NVD lists gstreamer with no version ("-") only: unanalysed, not confirmed for 1.22.12 |
| CVE-2026-3184 | P2 | 3.7 | util-linux 2.39.3 | NVD lists util-linux with no version ("-") only: unanalysed, not confirmed for 2.39.3 |
| CVE-2026-3832 | P2 | 3.7 | gnutls 3.8.10 | NVD lists gnutls with no version ("-") only: unanalysed, not confirmed for 3.8.10 |
unzip 14, libpcap 2, coreutils 1, busybox 1, wpa-supplicant 1, util-linux-libuuid 1, ofono 1, gcc-cross-aarch64 1, nano 1
not found: the Electron 43.0.0 runtime (meta-optisigns-poky-common/recipes-optisigns/optisigns-osui-runtime/optisigns-osui-runtime_43.0.0.bb) does not state its Chromium build, so the browser engine is not matched against NVD
bl31, OP-TEE bl32, SPL, DDR): vendor blobs, no NVD mapping.3 / 6 · Kernel
Kernel 6.1.99: 82 CVEs still matched and not fixed (every bucket), by area.
1 P0 items, highest CVSS first.
| CVE | Area | What it is | CVSS |
|---|---|---|---|
| CVE-2026-31448 | EXT4_FS | ext4: avoid infinite loops caused by residual data | 9.4 |
| CVE | Priority | CVSS | Area | What it is | Fix |
|---|---|---|---|---|---|
| Bluetooth · 43 (P1 40 · P2 3) | |||||
| CVE-2024-36013 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() | applies cleanlyBackport upstream commit 4d7b41c0e439 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-38620 Out of scope (not CRITICAL) | P1 | 8.8 | BT_MRVL | Bluetooth: HCI: Remove HCI_AMP support | needs reworkBackport upstream commit 84a4bb6548a2 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-41062 Out of scope (not CRITICAL) | P1 | 8.8 | BT | bluetooth/l2cap: sync sock recv cb and release | applies cleanlyBackport upstream commit 89e856e124f9 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-49950 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix uaf in l2cap_connect | needs reworkBackport upstream commit 333b4fd11e89 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-50029 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync | applies cleanlyBackport upstream commit 18fd04ad856d (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-53144 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE | applies cleanlyBackport upstream commit b25e11f978b6 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-53237 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: fix use-after-free in device_for_each_child() | applies cleanlyBackport upstream commit 27aabf27fd01 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-56591 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_conn: Use disable_delayed_work_sync | applies cleanlyBackport upstream commit 2b0f2fc9ed62 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2025-21969 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd | needs reworkBackport upstream commit b4f82f9ed43a — needs rework (context drifted) -> stage the patch… |
| CVE-2026-23395 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | applies cleanlyBackport vendor commit fb4a3a26483f (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-23462 Out of scope (not CRITICAL) | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: Fix possible UAF | applies cleanlyBackport vendor commit 21a47a119f33 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31408 Out of scope (not CRITICAL) | P1 | 8.8 | BT_BREDR | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing | applies cleanlyBackport upstream commit 598dbba9919c (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-31773 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: SMP: derive legacy responder STK authentication from MITM state | applies cleanlyBackport vendor commit 929db734d12d (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43018 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt | applies cleanlyBackport vendor commit 59eecf0ffde1 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43334 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: SMP: force responder MITM requirements before building the | applies cleanlyBackport upstream commit d05111bfe37b (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-46056 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | applies cleanlyBackport upstream commit 85fa35120487 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-52918 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: serialize accept_q access | needs reworkBackport vendor commit 4ec17782fd18 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-53071 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp | applies cleanlyBackport vendor commit 0ccd75c51f62 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53072 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER | applies cleanlyBackport vendor commit c7777f534a80 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53358 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() | needs reworkBackport vendor commit deb8493a8fa5 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-63946 Out of scope (not CRITICAL) | P1 | 8.8 | BT_LE | Bluetooth: ISO: fix UAF in iso_recv_frame | applies cleanlyBackport vendor commit c57ea90f203c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-63947 Out of scope (not CRITICAL) | P1 | 8.8 | BT_HIDP | Bluetooth: HIDP: fix missing length checks in hidp_input_report() | applies cleanlyBackport vendor commit cc3832b19f86 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-63975 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp | applies cleanlyBackport vendor commit e6833e737a51 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-64178 Out of scope (not CRITICAL) | P1 | 8.8 | BT_BNEP | Bluetooth: bnep: Fix UAF read of dev->name | applies cleanlyBackport vendor commit 915a92182e2c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-64206 Out of scope (not CRITICAL) | P1 | 8.8 | BT | Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock | needs reworkBackport vendor commit 4a0bb0fd63fe — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-64408 Out of scope (not CRITICAL) | P1 | 8.8 | BT_BNEP | Bluetooth: bnep: pin L2CAP connection during netdev registration | applies cleanlyBackport vendor commit 551ae773ec64 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-39889 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: l2cap: Check encryption key size on incoming connection | applies cleanlyBackport vendor commit c6d527bbd3d3 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31393 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access | applies cleanlyBackport vendor commit 3b646516cba2 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-31771 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: hci_event: move wake reason storage into validated event | needs reworkBackport upstream commit 2b2bf47cd755 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43134 Out of scope (not CRITICAL) | P1 | 8.1 | BT | Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ | applies cleanlyBackport vendor commit 9118601ff90b (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53254 Out of scope (not CRITICAL) | P1 | 8.1 | BT_RFCOMM | Bluetooth: RFCOMM: validate skb length in MCC handlers | applies cleanlyBackport vendor commit 0d637136ce89 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-50124 Out of scope (not CRITICAL) | P1 | 8.0 | BT_LE | Bluetooth: ISO: Fix UAF on iso_sock_timeout | applies cleanlyBackport upstream commit 246b435ad668 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2024-50125 Out of scope (not CRITICAL) | P1 | 8.0 | BT | Bluetooth: SCO: Fix UAF on sco_sock_timeout | applies cleanlyBackport upstream commit 1bf4470a3939 (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-53256 Out of scope (not CRITICAL) | P1 | 8.0 | BT_RFCOMM | Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() | applies cleanlyBackport vendor commit 1f73f92f6625 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53357 Out of scope (not CRITICAL) | P1 | 8.0 | BT | Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() | applies cleanlyBackport vendor commit 7eebd4c2c86f (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2024-36968 Out of scope (not CRITICAL) | P1 | 7.6 | BT | Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() | needs reworkBackport upstream commit a5b862c6a221 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-56590 Out of scope (not CRITICAL) | P1 | 7.6 | BT | Bluetooth: hci_core: Fix not checking skb length on | applies cleanlyBackport upstream commit 3fe288a8214e (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-43062 Out of scope (not CRITICAL) | P1 | 7.1 | BT | Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() | applies cleanlyBackport vendor commit 111f74547eee (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-53253 Out of scope (not CRITICAL) | P1 | 7.1 | BT_BNEP | Bluetooth: bnep: reject short frames before parsing | needs reworkBackport vendor commit 2b83afb19293 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-64403 Out of scope (not CRITICAL) | P1 | 7.1 | BT | Bluetooth: L2CAP: validate option length before reading conf opt value | applies cleanlyBackport vendor commit 7d871e969b94 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2022-42895 Out of scope (not CRITICAL) | P2 | 6.5 | BT | There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-28866 Out of scope (not CRITICAL) | P2 | 5.3 | BT | In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2022-3619 Out of scope (not CRITICAL) | P2 | 3.5 | BT | A vulnerability has been found in Linux Kernel and classified as problematic. This… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Network stack · 12 (P1 12) | |||||
| CVE-2026-63919 Out of scope (not CRITICAL) | P1 | 8.8 | XFRM | xfrm: input: hold netns during deferred transport reinjection | applies cleanlyBackport vendor commit 8dfabcba6a94 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43139 Out of scope (not CRITICAL) | P1 | 8.6 | XFRM | xfrm6: fix uninitialized saddr in xfrm6_get_saddr() | needs reworkBackport vendor commit eb2ee15290af — needs rework (context drifted) -> stage the patch i… |
| CVE-2025-21760 Out of scope (not CRITICAL) | P1 | 8.1 | IPV6 | ndisc: extend RCU protection in ndisc_send_skb() | applies cleanlyBackport vendor commit a9319d800b57 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21762 Out of scope (not CRITICAL) | P1 | 8.1 | INET | arp: use RCU protection in arp_xmit() | applies cleanlyBackport vendor commit f18965445942 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21765 Out of scope (not CRITICAL) | P1 | 8.1 | IPV6 | ipv6: use RCU protection in ip6_default_advmss() | applies cleanlyBackport vendor commit 84212387caad (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-21766 Out of scope (not CRITICAL) | P1 | 8.1 | INET | ipv4: use RCU protection in __ip_rt_update_pmtu() | needs reworkBackport vendor commit ea07480b2322 — needs rework (context drifted) -> stage the patch i… |
| CVE-2024-41007 Out of scope (not CRITICAL) | P1 | 7.5 | INET | tcp: avoid too many retransmit packets | needs reworkBackport upstream commit 97a9063518f1 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-53124 Out of scope (not CRITICAL) | P1 | 7.5 | IPV6 | net: fix data-races around sk->sk_forward_alloc | needs reworkBackport upstream commit 073d89808c06 — needs rework (context drifted) -> stage the patch… |
| CVE-2024-56703 Out of scope (not CRITICAL) | P1 | 7.5 | IPV6 | ipv6: Fix soft lockups in fib6_select_path under high next hop churn | needs reworkBackport upstream commit d9ccb18f83ea — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43101 Out of scope (not CRITICAL) | P1 | 7.5 | IPV6 | ipv6: ioam: fix potential NULL dereferences in | needs reworkBackport upstream commit 4e65a8b8daa1 — needs rework (context drifted) -> stage the patch… |
| CVE-2026-52981 Out of scope (not CRITICAL) | P1 | 7.5 | NET | neigh: let neigh_xmit take skb ownership | needs reworkBackport vendor commit 8a89054a1ec0 — needs rework (context drifted) -> stage the patch i… |
| CVE-2026-98096 Out of scope (not CRITICAL) | P1 | 7.4 | IPV6 | ipv6: sr: restore network header before routing and forwarding | applies cleanlyBackport upstream commit 975b5b067f52 (applies cleanly) -> stage the patch in meta-optisi… |
| Unmapped (older advisories) · 11 (P1 3 · P2 8) | |||||
| CVE-2026-64374 Out of scope (not CRITICAL) | P1 | 7.5 | unmapped | sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT | applies cleanlyBackport vendor commit 44aae426dbfd (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2019-14899 Out of scope (not CRITICAL) | P1 | 7.4 | unmapped | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2008-4609 Out of scope (not CRITICAL) | P1 | 7.1 | unmapped | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows,… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24857 Out of scope (not CRITICAL) | P2 | 6.8 | unmapped | A race condition was found in the Linux kernel's net/bluetooth device driver in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-6240 Out of scope (not CRITICAL) | P2 | 6.5 | unmapped | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2023-1206 Out of scope (not CRITICAL) | P2 | 5.7 | unmapped | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24858 Out of scope (not CRITICAL) | P2 | 5.3 | unmapped | A race condition was found in the Linux kernel's net/bluetooth in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2010-4563 Out of scope (not CRITICAL) | P2 | 5.0 | unmapped | The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24859 Out of scope (not CRITICAL) | P2 | 4.8 | unmapped | A race condition was found in the Linux kernel's net/bluetooth in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-24860 Out of scope (not CRITICAL) | P2 | 4.6 | unmapped | A race condition was found in the Linux kernel's bluetooth device driver in… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-21803 Out of scope (not CRITICAL) | P2 | 3.5 | unmapped | Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| Other drivers and core · 11 (P0 1 · P1 7 · P2 3) | |||||
| CVE-2026-31448 No official patch | P0 | 9.4 | EXT4_FS | ext4: avoid infinite loops caused by residual data | needs reworkBackport vendor commit c66545e83a80 — needs rework (context drifted) -> stage the patch i… |
| CVE-2025-38495 Out of scope (not CRITICAL) | P1 | 8.8 | HID | HID: core: ensure the allocated report buffer can contain the reserved report ID | applies cleanlyBackport vendor commit d3ed1d84a845 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-43048 Out of scope (not CRITICAL) | P1 | 8.8 | HID | HID: core: Mitigate potential OOB by removing bogus memset() | applies cleanlyBackport upstream commit 0a3fe972a7cb (applies cleanly) -> stage the patch in meta-optisi… |
| CVE-2026-64313 Out of scope (not CRITICAL) | P1 | 8.8 | CRYPTO_ECC | crypto: ecc - Fix carry overflow in vli multiplication | applies cleanlyBackport vendor commit 24a54dfa06d0 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2025-71161 Out of scope (not CRITICAL) | P1 | 7.5 | DM_VERITY | dm-verity: disable recursive forward error correction | needs reworkBackport upstream commit d9f3e47d3fae — needs rework (context drifted) -> stage the patch… |
| CVE-2026-43336 Out of scope (not CRITICAL) | P1 | 7.5 | CRYPTO | lib/crypto: chacha: Zeroize permuted_state before it leaves scope | needs reworkBackport upstream commit e5046823f8fa — needs rework (context drifted) -> stage the patch… |
| CVE-2024-57986 Out of scope (not CRITICAL) | P1 | 7.1 | HID | HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections | applies cleanlyBackport vendor commit bebf542e8d7c (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-46078 Out of scope (not CRITICAL) | P1 | 7.1 | EROFS_FS | erofs: fix the out-of-bounds nameoff handling for trailing dirents | needs reworkBackport upstream commit d18a3b5d337f — needs rework (context drifted) -> stage the patch… |
| CVE-2026-64146 Out of scope (not CRITICAL) | P2 | 5.5 | EROFS_FS_XATTR | erofs: fix metabuf leak in inode xattr initialization | needs reworkBackport upstream commit 79b09c54c656 — needs rework (context drifted) -> stage the patch… |
| CVE-2022-3523 Out of scope (not CRITICAL) | P2 | 5.3 | MMU | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is… | no fixing commitNo fixing commit on record — find the upstream fix, or assess |
| CVE-2024-35878 Out of scope (not CRITICAL) | P2 | 5.3 | OF | of: module: prevent NULL pointer dereference in vsnprintf() | needs reworkBackport upstream commit a1aa5390cc91 — needs rework (context drifted) -> stage the patch… |
| WiFi · 3 (P1 3) | |||||
| CVE-2025-38643 Out of scope (not CRITICAL) | P1 | 8.8 | CFG80211 | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | needs reworkBackport upstream commit 2c5dee15239f — needs rework (context drifted) -> stage the patch… |
| CVE-2025-39849 Out of scope (not CRITICAL) | P1 | 8.8 | CFG80211 | wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() | applies cleanlyBackport vendor commit 8e751d463362 (applies cleanly) -> stage the patch in meta-optisign… |
| CVE-2026-46125 Out of scope (not CRITICAL) | P1 | 8.8 | MAC80211 | wifi: mac80211: remove station if connection prep fails | needs reworkBackport upstream commit 283fc9e44ff5 — needs rework (context drifted) -> stage the patch… |
| Ethernet driver · 2 (P1 2) | |||||
| CVE-2026-53232 Out of scope (not CRITICAL) | P1 | 8.8 | PHYLIB | net: phy: clean the sfp upstream if phy probing fails | needs reworkBackport upstream commit 48774e87bbaa — needs rework (context drifted) -> stage the patch… |
| CVE-2026-46110 Out of scope (not CRITICAL) | P1 | 7.5 | STMMAC_ETH | net: stmmac: Prevent NULL deref when RX memory exhausted | needs reworkBackport upstream commit 0bb05e6adfa9 — needs rework (context drifted) -> stage the patch… |
Patches go in meta-optisigns-rk3576-common/recipes-cve/linux-rockchip-gaidatech/, one module per subsystem; kernel C patches are never shared across vendor trees.
4 / 6 · Userland
115 rows in 22 packages still matched and not fixed (every bucket). One version change per package closes its rows. The target is the lowest version that closes every row with a known affected range.
| Package | Now | Target | Rows | Where the change goes |
|---|---|---|---|---|
| python3-pillow | 10.3.0 | ≥13.0.0 | 40 | RK only: copy the upstream recipe dir (poky/meta-openembedded/meta-python/recipes-devtools/python/, all its files) to meta-optisigns-rk3576-common/recipes-cve/python3-pillow/ as python3-pillow_<new>.bb, pin PREFERRED_VERSION_python3-pillow in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| rsync · also in boot.img, recovery.img | 3.2.7 | >3.5.1 | 16 | bump meta-optisigns-poky5/recipes-cve/rsync/rsync_3.2.7.bb · ALSO INTEL |
| bluez5 | 5.66 | ≥5.70 | 9 | bump meta-optisigns-poky5/recipes-connectivity/bluez5/bluez5_5.66.bb · ALSO INTEL |
| cups | 2.4.15 | ≥2.4.20 | 7 | bump meta-optisigns-poky5/recipes-cve/cups/cups_2.4.15.bb · ALSO INTEL |
| python3 · also in boot.img, recovery.img | 3.12.12 | ≥3.14.7 | 6 | bump meta-optisigns-poky5/recipes-cve/python/python3_3.12.12.bb · ALSO INTEL |
| expat · also in boot.img, recovery.img | 2.7.5 | >2.9.0 | 5 | bump meta-optisigns-poky5/recipes-cve/expat/expat_2.7.5.bb · ALSO INTEL |
| python3-urllib3 | 2.2.2 | ≥2.8.0 | 4 | bump meta-optisigns-poky5/recipes-cve/python/python3-urllib3_2.2.2.bb · ALSO INTEL |
| binutils | 2.42 | >2.46 | 3 | RK only: copy the upstream recipe dir (poky/meta/recipes-devtools/binutils/, all its files) to meta-optisigns-rk3576-common/recipes-cve/binutils/ as binutils_<new>.bb, pin PREFERRED_VERSION_binutils in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| jq | 1.7.1 | ≥1.8.2 | 3 | bump meta-optisigns-poky5/recipes-cve/jq/jq_1.7.1.bb · ALSO INTEL |
| libsndfile1 | 1.2.2 | >1.2.2 | 3 | no fixed upstream release (the fix is only after 1.2.2, which is current): carry patches in meta-optisigns-poky5/recipes-cve/libsndfile/libsndfile1_1.2.2.bb · ALSO INTEL |
| dnsmasq | 2.90 | ≥2.93 | 2 | RK only: copy the upstream recipe dir (poky/meta-openembedded/meta-networking/recipes-support/dnsmasq/, all its files) to meta-optisigns-rk3576-common/recipes-cve/dnsmasq/ as dnsmasq_<new>.bb, pin PREFERRED_VERSION_dnsmasq in meta-optisigns-rk3576-common/conf/local-rk3576-base.conf; the poky recipe stays for Intel · ALSO INTEL |
| gstreamer1.0 | 1.22.12 | ≥1.28.1 | 2 | bump meta-optisigns-poky5/recipes-cve/gstreamer/gstreamer1.0_1.22.12.bb · ALSO INTEL |
22 of 22 packages sit in a layer the Intel build also uses, so their change ships to both lines and must be validated on both. 11 rows have no affected range in NVD and need a manual check before acting.
| CVE | Priority | CVSS | What it is | Fix suggestion |
|---|---|---|---|---|
| python3-pillow 10.3.0 → ≥13.0.0 · 40 (P0 1 · P1 33 · P2 6) | ||||
| CVE-2026-54058 No official patch | P0 | 9.1 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-96778 Out of scope (not CRITICAL) | P1 | 8.8 | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112394 Out of scope (not CRITICAL) | P1 | 8.2 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112395 Out of scope (not CRITICAL) | P1 | 8.2 | Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112404 Out of scope (not CRITICAL) | P1 | 8.2 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-59197 Out of scope (not CRITICAL) | P1 | 8.2 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-96644 Out of scope (not CRITICAL) | P1 | 8.1 | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112390 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112391 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value()… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112392 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112397 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112399 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112400 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112401 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112402 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112406 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112891 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112892 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112893 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112894 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112895 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112901 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-25990 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may… | Upgrade pillow 10.3.0 → ≥12.1.1 |
| CVE-2026-40192 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of… | Upgrade pillow 10.3.0 → ≥12.2.0 |
| CVE-2026-54059 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-54060 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile()… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-55379 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-55380 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open()… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59198 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59199 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59200 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59204 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-59205 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's… | Upgrade pillow 10.3.0 → ≥12.3.0 |
| CVE-2026-96640 Out of scope (not CRITICAL) | P1 | 7.5 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree()… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-96636 Out of scope (not CRITICAL) | P2 | 6.5 | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-96637 Out of scope (not CRITICAL) | P2 | 6.5 | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-96638 Out of scope (not CRITICAL) | P2 | 6.5 | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-96641 Out of scope (not CRITICAL) | P2 | 6.5 | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-96642 Out of scope (not CRITICAL) | P2 | 6.5 | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| CVE-2026-112898 Out of scope (not CRITICAL) | P2 | 5.3 | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized… | Upgrade pillow 10.3.0 → ≥13.0.0 |
| rsync 3.2.7 → >3.5.1 · also in boot.img, recovery.img · 16 (P1 8 · P2 8) | ||||
| CVE-2026-70457 Out of scope (not CRITICAL) | P1 | 8.2 | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70461 Out of scope (not CRITICAL) | P1 | 8.2 | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-43618 Out of scope (not CRITICAL) | P1 | 8.1 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-53789 Out of scope (not CRITICAL) | P1 | 8.1 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53795 Out of scope (not CRITICAL) | P1 | 8.1 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70463 Out of scope (not CRITICAL) | P1 | 8.1 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-119741 Out of scope (not CRITICAL) | P1 | 7.5 | rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's… | Upgrade rsync 3.2.7 → >3.5.1 |
| CVE-2026-70464 Out of scope (not CRITICAL) | P1 | 7.5 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-43620 Out of scope (not CRITICAL) | P2 | 6.5 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-53786 Out of scope (not CRITICAL) | P2 | 6.5 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70462 Out of scope (not CRITICAL) | P2 | 6.5 | rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53801 Out of scope (not CRITICAL) | P2 | 5.9 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-53798 Out of scope (not CRITICAL) | P2 | 5.3 | rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-70459 Out of scope (not CRITICAL) | P2 | 5.3 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child… | Upgrade rsync 3.2.7 → ≥3.5.0 |
| CVE-2026-43617 Out of scope (not CRITICAL) | P2 | 4.8 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… | Upgrade rsync 3.2.7 → >3.4.2 |
| CVE-2026-45232 Out of scope (not CRITICAL) | P2 | 3.1 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in… | Upgrade rsync 3.2.7 → ≥3.4.3 |
| bluez5 5.66 → ≥5.70 · 9 (P1 5 · P2 4) | ||||
| CVE-2023-27349 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-44431 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability.… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-50229 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-50230 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | Upgrade bluez 5.66 → ≥5.70 |
| CVE-2023-51596 Out of scope (not CRITICAL) | P1 | 7.1 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51580 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51589 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51592 Out of scope (not CRITICAL) | P2 | 5.4 | BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| CVE-2023-51594 Out of scope (not CRITICAL) | P2 | 2.6 | BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability… | NVD confirms 5.66 (exact version / open range) but names no fixed release: find the upstr… |
| cups 2.4.15 → ≥2.4.20 · 7 (P1 1 · P2 6) | ||||
| CVE-2026-34980 Out of scope (not CRITICAL) | P1 | 7.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-107886 Out of scope (not CRITICAL) | P2 | 6.5 | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When… | Upgrade cups 2.4.15 → ≥2.4.20 |
| CVE-2026-34978 Out of scope (not CRITICAL) | P2 | 6.5 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-41079 Out of scope (not CRITICAL) | P2 | 5.4 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → ≥2.4.17 |
| CVE-2026-34979 Out of scope (not CRITICAL) | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| CVE-2026-61702 Out of scope (not CRITICAL) | P2 | 5.3 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → ≥2.4.20 |
| CVE-2026-27447 Out of scope (not CRITICAL) | P2 | 4.8 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating… | Upgrade cups 2.4.15 → >2.4.16 |
| python3 3.12.12 → ≥3.14.7 · also in boot.img, recovery.img · 6 (P1 4 · P2 2) | ||||
| CVE-2026-15308 Out of scope (not CRITICAL) | P1 | 7.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through… | Upgrade python 3.12.12 → ≥3.12.14 |
| CVE-2026-3087 Out of scope (not CRITICAL) | P1 | 7.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a… | Upgrade python 3.12.12 → >3.14.4 |
| CVE-2026-3644 Out of scope (not CRITICAL) | P1 | 7.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… | Upgrade python 3.12.12 → ≥3.13.13 |
| CVE-2026-7210 Out of scope (not CRITICAL) | P1 | 7.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat… | Upgrade python 3.12.12 → ≥3.13.14 |
| CVE-2026-6019 Out of scope (not CRITICAL) | P2 | 6.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for… | Upgrade python 3.12.12 → ≥3.13.14 |
| CVE-2025-12781 Out of scope (not CRITICAL) | P2 | 5.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions… | Upgrade python 3.12.12 → ≥3.13.10 |
| expat 2.7.5 → >2.9.0 · also in boot.img, recovery.img · 5 (P1 5) | ||||
| CVE-2026-118370 Out of scope (not CRITICAL) | P1 | 8.2 | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in… | Upgrade libexpat 2.7.5 → >2.9.0 |
| CVE-2026-113351 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because… | Upgrade libexpat 2.7.5 → >2.9.0 |
| CVE-2026-115506 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs… | Upgrade libexpat 2.7.5 → >2.9.0 |
| CVE-2026-117610 Out of scope (not CRITICAL) | P1 | 7.5 | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in… | Upgrade libexpat 2.7.5 → >2.9.0 |
| CVE-2026-66046 Out of scope (not CRITICAL) | P1 | 7.5 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic… | Upgrade libexpat 2.7.5 → >2.8.3 |
| python3-urllib3 2.2.2 → ≥2.8.0 · 4 (P1 2 · P2 2) | ||||
| CVE-2026-97687 Out of scope (not CRITICAL) | P1 | 8.1 | urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context,… | Upgrade urllib3 2.2.2 → ≥2.8.0 |
| CVE-2026-97689 Out of scope (not CRITICAL) | P1 | 7.5 | urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the… | Upgrade urllib3 2.2.2 → ≥2.8.0 |
| CVE-2025-50182 Out of scope (not CRITICAL) | P2 | 5.3 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior… | Upgrade urllib3 2.2.2 → ≥2.5.0 |
| CVE-2026-44431 Out of scope (not CRITICAL) | P2 | 5.3 | urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin… | Upgrade urllib3 2.2.2 → ≥2.7.0 |
| binutils 2.42 → >2.46 · 3 (P1 2 · P2 1) | ||||
| CVE-2025-69649 Out of scope (not CRITICAL) | P1 | 7.5 | GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when… | Upgrade binutils 2.42 → >2.46 |
| CVE-2025-69650 Out of scope (not CRITICAL) | P1 | 7.5 | GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted… | Upgrade binutils 2.42 → >2.46 |
| CVE-2025-0840 Out of scope (not CRITICAL) | P2 | 5.0 | A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43.… | Upgrade binutils 2.42 → ≥2.44 |
| jq 1.7.1 → ≥1.8.2 · 3 (P1 2 · P2 1) | ||||
| CVE-2026-32316 Out of scope (not CRITICAL) | P1 | 8.2 | jq is a command-line JSON processor. An integer overflow vulnerability exists through version… | Upgrade jq 1.7.1 → >1.8.1 |
| CVE-2026-39979 Out of scope (not CRITICAL) | P1 | 8.2 | jq is a command-line JSON processor. In commits before… | Upgrade jq 1.7.1 → ≥1.8.2 |
| CVE-2026-33948 Out of scope (not CRITICAL) | P2 | 5.3 | jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b… | Upgrade jq 1.7.1 → ≥1.8.2 |
| libsndfile1 1.2.2 → >1.2.2 · 3 (P1 2 · P2 1) | ||||
| CVE-2025-52194 Out of scope (not CRITICAL) | P1 | 7.5 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier… | Upgrade libsndfile 1.2.2 → >1.2.2 |
| CVE-2026-37555 Out of scope (not CRITICAL) | P1 | 7.5 | An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was… | NVD confirms 1.2.2 (exact version / open range) but names no fixed release: find the upst… |
| CVE-2024-50613 Out of scope (not CRITICAL) | P2 | 6.5 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in… | Upgrade libsndfile 1.2.2 → >1.2.2 |
| dnsmasq 2.90 → ≥2.93 · 2 (P2 2) | ||||
| CVE-2026-12725 Out of scope (not CRITICAL) | P2 | 5.9 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging… | Upgrade dnsmasq 2.90 → ≥2.93 |
| CVE-2026-12969 Out of scope (not CRITICAL) | P2 | 5.3 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c.… | Upgrade dnsmasq 2.90 → ≥2.93 |
| gstreamer1.0 1.22.12 → ≥1.28.1 · 2 (P1 2) | ||||
| CVE-2026-3083 Out of scope (not CRITICAL) | P1 | 8.8 | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.22.12 → ≥1.28.1 |
| CVE-2026-3085 Out of scope (not CRITICAL) | P1 | 8.8 | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This… | Upgrade gstreamer 1.22.12 → ≥1.28.1 |
| libsolv 0.7.28 → >0.7.36 · 2 (P2 2) | ||||
| CVE-2026-9149 Out of scope (not CRITICAL) | P2 | 6.5 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim… | Upgrade libsolv 0.7.28 → >0.7.36 |
| CVE-2026-9150 Out of scope (not CRITICAL) | P2 | 6.5 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in… | Upgrade libsolv 0.7.28 → >0.7.36 |
| libxml2 2.12.10 → ≥2.15.2 · also in boot.img, recovery.img · 2 (P2 2) | ||||
| CVE-2026-0990 Out of scope (not CRITICAL) | P2 | 5.9 | A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability… | Upgrade libxml2 2.12.10 → ≥2.15.2 |
| CVE-2026-0989 Out of scope (not CRITICAL) | P2 | 3.7 | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema… | Upgrade libxml2 2.12.10 → ≥2.15.2 |
| luajit 2.1 → >2.1.0_beta3 · 2 (P1 2) | ||||
| CVE-2020-15890 Out of scope (not CRITICAL) | P1 | 7.5 | LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is… | NVD confirms 2.1 (exact version / open range) but names no fixed release: find the upstre… |
| CVE-2020-24372 Out of scope (not CRITICAL) | P1 | 7.5 | LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. | NVD confirms 2.1 (exact version / open range) but names no fixed release: find the upstre… |
| protobuf 4.25.3 → >33.4 · 2 (P1 2) | ||||
| CVE-2024-7254 Out of scope (not CRITICAL) | P1 | 7.5 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of… | Upgrade protobuf 4.25.3 → ≥4.27.5 |
| CVE-2026-0994 Out of scope (not CRITICAL) | P1 | 7.5 | A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in… | Upgrade protobuf 4.25.3 → >33.4 |
| python3-cryptography 42.0.5 → ≥46.0.6 · 2 (P2 2) | ||||
| CVE-2026-26007 Out of scope (not CRITICAL) | P2 | 6.5 | cryptography is a package designed to expose cryptographic primitives and recipes to Python… | Upgrade cryptography 42.0.5 → ≥46.0.5 |
| CVE-2026-34073 Out of scope (not CRITICAL) | P2 | 5.3 | cryptography is a package designed to expose cryptographic primitives and recipes to Python… | Upgrade cryptography 42.0.5 → ≥46.0.6 |
| gdk-pixbuf 2.42.12 → ≥2.44.6 · 1 (P1 1) | ||||
| CVE-2026-5201 Out of scope (not CRITICAL) | P1 | 7.5 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability… | Upgrade gdk-pixbuf 2.42.12 → ≥2.44.6 |
| libpcre2 10.43 → >10.48_rc1 · 1 (P2 1) | ||||
| CVE-2026-89160 Out of scope (not CRITICAL) | P2 | 3.7 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF… | Upgrade pcre2 10.43 → ≥10.48 |
| python3-ply 3.11 → >3.11 · 1 (P0 1) | ||||
| CVE-2025-56005 Upstream: not affected | P0 | 9.8 | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote… | NVD confirms 3.11 (exact version / open range) but names no fixed release: find the upstr… |
| sqlite3 3.45.3 → ≥3.51.1 · also in boot.img, recovery.img · 1 (P1 1) | ||||
| CVE-2025-70873 Out of scope (not CRITICAL) | P1 | 7.5 | An information disclosure issue in the zipfileInflate function in the zipfile extension in… | Upgrade sqlite 3.45.3 → ≥3.51.1 |
| xz 5.4.6 → ≥5.8.3 · also in boot.img, recovery.img · 1 (P2 1) | ||||
| CVE-2026-34743 Out of scope (not CRITICAL) | P2 | 5.3 | XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to… | Upgrade xz 5.4.6 → ≥5.8.3 |
5 / 6 · U-Boot
U-Boot 2017.09: 29 CVEs still matched and not fixed (every bucket); 11 ruled out on evidence from this build. Bootloader changes go last in the fix plan.
| CVE | Priority | CVSS | What it is | Fix |
|---|---|---|---|---|
| CVE-2018-18439 Fixed, version does not show it | P0 | 9.8 | DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-11059 Fixed, version does not show it | P0 | 9.8 | Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14192 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14193 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14194 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14195 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14196 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14198 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14199 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14200 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14201 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14202 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14203 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-14204 Fixed, version does not show it | P0 | 9.8 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2020-8432 Fixed, version does not show it | P0 | 9.8 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2022-30767 Fixed, version does not show it | P0 | 9.8 | nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2026-29009 Fixed, version does not show it | P0 | 9.8 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply()… | no fixing commitNo vendor patch — backport from upstream U-Boot |
| CVE-2019-14197 Fixed, version does not show it | P0 | 9.1 | An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2024-42040 Out of scope (not CRITICAL) | P1 | 8.1 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2018-18440 Out of scope (not CRITICAL) | P1 | 7.8 | DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13104 Out of scope (not CRITICAL) | P1 | 7.8 | In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13106 Out of scope (not CRITICAL) | P1 | 7.8 | Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2021-27097 Out of scope (not CRITICAL) | P1 | 7.8 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2021-27138 Out of scope (not CRITICAL) | P1 | 7.8 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2025-24857 Out of scope (not CRITICAL) | P1 | 7.6 | Improper access control for volatile memory containing boot code in Universal Boot Loader… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-13103 Out of scope (not CRITICAL) | P1 | 7.1 | A crafted self-referential DOS partition table will cause all Das U-Boot versions through… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2024-57256 Out of scope (not CRITICAL) | P1 | 7.1 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2024-57258 Out of scope (not CRITICAL) | P1 | 7.1 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE-2019-11690 Out of scope (not CRITICAL) | P2 | 5.9 | gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which… | applies cleanlyVendor patch archived (u-boot/cve-archive/nextdev) — apply + hardware validation |
| CVE | Ruling | Reason |
|---|---|---|
| CVE-2018-1000205 | not-built | fix touches common/image-sig.c not-built, tools/image-host.c host |
| CVE-2020-10648 | not-built | fix touches common/image-sig.c not-built |
| CVE-2022-2347 | not-built | fix touches drivers/usb/gadget/f_dfu.c not-built |
| CVE-2022-34835 | not-built | fix touches cmd/i2c.c not-built |
| CVE-2024-57254 | code-absent | no sqfs_inode_size anywhere in our U-Boot source |
| CVE-2024-57255 | code-absent | no sqfs_resolve_symlink anywhere in our U-Boot source |
| CVE-2024-57257 | code-absent | no sqfs_size anywhere in our U-Boot source |
| CVE-2024-57259 | code-absent | no sqfs_search_dir anywhere in our U-Boot source |
| CVE-2026-29007 | code-absent | no rmt_timestamp, rmt_win_scale, tcp_parse_options, tcp_rx_state_machine anywhere in our U-Boot source (net/tcp.c absent too) |
| CVE-2026-29008 | stored-judgement | integer underflow in tcp_rx_state_machine() (net/tcp.c); our 2017.09 U-Boot has no TCP stack (net/tcp.c absent, no CONFIG_PROT_TCP). The summary also names sto… |
| CVE-2026-46728 | not-built | fix touches common/image-sig.c not-built |
ledger
From the in-repo ledger docs/security/cve/rk: 17 fix record(s) merged here. Work on other branches is not shown.
Need a fix: 0 · Fixed, version does not show it: 18 · No official patch: 2 · Upstream: not affected: 222 · Out of scope (not CRITICAL): 205
29 CVE(s) listed fixed in the ledger are still matched by this scan, whose source contains the fix: fixed, the version does not show it (the scan matches on the version alone).
| Record | Fixed by | Date | MR | CVEs fixed | In this image |
|---|---|---|---|---|---|
| rk-cve-fix-001 | wilber | 2026-10-06 | !359 | 38 | all |
| rk-cve-fix-002 | wilber | 2026-10-08 | !391 | 3 | all |
| rk-cve-fix-003 | wilber | 2026-10-11 | !425 | 3 | all |
| rk-cve-fix-004 | wilber | 2026-10-23 | !651 | 12 | all |
| rk-cve-fix-005 | wilber | 2026-10-24 | !670 | 22 | all |
| rk-cve-fix-006 | wilber | 2026-10-24 | !670 | 4 | all |
| rk-cve-fix-007 | wilber | 2026-10-24 | !670 | 3 | all |
| rk-cve-fix-008 | wilber | 2026-10-24 | !670 | 3 | all |
| rk-cve-fix-009 | wilber | 2026-11-01 | !737 | 1 | all |
| rk-cve-fix-010 | wilber | 2026-11-01 | !737 | 1 | all |
| rk-cve-fix-011 | wilber | 2026-11-01 | !737 | 1 | all |
| rk-cve-fix-012 | wilber | 2026-11-02 | !745 | 29 | all |
| rk-cve-fix-013 | wilber | 2026-11-04 | !773 | 1 | all |
| rk-cve-fix-014 | wilber | 2026-11-04 | !773 | 1 | all |
| rk-cve-fix-015 | wilber | 2026-11-04 | !773 | 4 | all |
| rk-cve-fix-016 | wilber | 2026-11-04 | !777 | 6 | all |
| rk-cve-fix-017 | wilber | 2026-11-04 | !777 | 1 | all |
| CVE | Fixed by | Date | Record | MR | Now |
|---|---|---|---|---|---|
| CVE-2024-42247 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-44985 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-44986 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-47678 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2024-47682 | wilber | 2026-10-24 | rk-cve-fix-007 | !670 | fixed |
| CVE-2024-49978 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-50033 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-53058 | wilber | 2026-10-24 | rk-cve-fix-006 | !670 | fixed |
| CVE-2024-56644 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2024-57947 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2025-15467 | wilber | 2026-11-04 | rk-cve-fix-013 | !773 | fixed |
| CVE-2025-39864 | wilber | 2026-10-24 | rk-cve-fix-006 | !670 | fixed |
| CVE-2025-71127 | wilber | 2026-10-24 | rk-cve-fix-006 | !670 | fixed |
| CVE-2026-10536 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-112393 | wilber | 2026-11-04 | rk-cve-fix-015 | !773 | fixed |
| CVE-2026-112398 | wilber | 2026-11-04 | rk-cve-fix-015 | !773 | fixed |
| CVE-2026-112403 | wilber | 2026-11-04 | rk-cve-fix-015 | !773 | fixed |
| CVE-2026-112900 | wilber | 2026-11-04 | rk-cve-fix-015 | !773 | fixed |
| CVE-2026-11352 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11564 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11586 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-11856 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-12064 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-13221 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-13608 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-18924 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-19931 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-31405 | wilber | 2026-10-24 | rk-cve-fix-008 | !670 | fixed |
| CVE-2026-31450 | wilber | 2026-10-24 | rk-cve-fix-007 | !670 | fixed |
| CVE-2026-31649 | wilber | 2026-10-24 | rk-cve-fix-006 | !670 | fixed |
| CVE-2026-33416 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-33636 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-40393 | wilber | 2026-11-04 | rk-cve-fix-014 | !773 | fixed |
| CVE-2026-40467 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-40468 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-40553 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-4176 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-43038 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43071 | wilber | 2026-11-01 | rk-cve-fix-009 | !737 | fixed |
| CVE-2026-43083 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2026-43099 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43186 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43194 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43198 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2026-43341 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43452 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-43501 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-45843 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-46037 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-46266 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2026-46303 | wilber | 2026-10-24 | rk-cve-fix-007 | !670 | fixed |
| CVE-2026-46306 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-47162 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-4873 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-52859 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-52946 | wilber | 2026-10-24 | rk-cve-fix-008 | !670 | fixed |
| CVE-2026-52982 | wilber | 2026-11-04 | rk-cve-fix-017 | !777 | fixed |
| CVE-2026-53006 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-53184 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-53275 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-53384 | wilber | 2026-10-24 | rk-cve-fix-008 | !670 | fixed |
| CVE-2026-5545 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-55999 | wilber | 2026-10-08 | rk-cve-fix-002 | !391 | fixed |
| CVE-2026-56001 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-56002 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-56003 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-5773 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-58010 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58011 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58012 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58013 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58014 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58015 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-58016 | wilber | 2026-10-23 | rk-cve-fix-004 | !651 | fixed |
| CVE-2026-6253 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-6276 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-63808 | wilber | 2026-11-01 | rk-cve-fix-011 | !737 | fixed |
| CVE-2026-63922 | wilber | 2026-11-04 | rk-cve-fix-016 | !777 | fixed |
| CVE-2026-63924 | wilber | 2026-11-01 | rk-cve-fix-010 | !737 | fixed |
| CVE-2026-63992 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-63994 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-64116 | wilber | 2026-10-24 | rk-cve-fix-005 | !670 | fixed |
| CVE-2026-6429 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-7009 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-7168 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-73078 | wilber | 2026-10-11 | rk-cve-fix-003 | !425 | fixed |
| CVE-2026-80229 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80230 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80231 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-80255 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-82208 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-82209 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8286 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8458 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8924 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8925 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8926 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8927 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-8932 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9079 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9080 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9545 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9546 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2026-9547 | wilber | 2026-10-06 | rk-cve-fix-001 | !359 | fixed |
| CVE-2018-18439 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2018-18440 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-11059 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-11690 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-13103 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-13104 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-13106 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14192 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14193 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14194 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14195 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14196 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14197 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14198 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14199 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14200 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14201 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14202 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14203 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2019-14204 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2020-8432 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2021-27097 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2021-27138 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2022-30767 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2024-42040 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2024-57256 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2024-57258 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2025-24857 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
| CVE-2026-29009 | wilber | 2026-11-02 | rk-cve-fix-012 | !745 | fixed, version does not show it (rk-cve-fix-012, MR !745): u-boot 2017.09 |
6 / 6 · Fix plan
One change per step, each built, bench-tested and revertable on its own. Start at the top.
| # | Fix and how | Closes | Risks | Rollback |
|---|---|---|---|---|
| 1 | Recommended · do first Patch 13 leaf packages, one commit each
| 86 userland rows |
| Revert that package's commit; nothing else depends on it. |
| 2 | Recommended Backport the 42 kernel fixes that apply cleanly, one module per subsystem
| 42 kernel rows |
| Revert the module's commit (each subsystem is its own); on a device, the A/B slot falls back after three failed boots. |
| 3 | Next Patch the 6 foundation packages, each on its own
| 23 userland rows |
| Revert that package's commit; the rest of the batch stays. |
| 4 | As time allows Hand-check the rest
| 56 rows |
| Each is its own commit. |
Every number on these pages comes from fixlist.json for the build and NVD snapshot named on page 1; re-run when either changes. Full list with each fix: fixlist.html.