| ASI-2026-0001 | HIGH | 8.4 | In elf_load_dynamic of elf.c, there is a possible arbitrary kernel memory write due to a missing bou... | 2026-07-19 |
| ASI-2026-0002 | HIGH | 7.1 | In tar_extract of tarfmt.c and the extraction routine of zipfmt.c, archive entry names are used to c... | 2026-07-20 |
| ASI-2026-0003 | MEDIUM | 5.3 | In dns_resolve of dns.c, the DNS response parser advances a read position through a fixed-size stack... | 2026-07-20 |
| ASI-2026-0004 | HIGH | 7.1 | In png_decode of png.c, the row stride is computed as width multiplied by channel count using 32-bit... | 2026-07-20 |
| ASI-2026-0005 | HIGH | 7.8 | In decode_ics of aac_decoder.c, the max_sfb field is read directly from the AAC bitstream as an unva... | 2026-07-20 |
| ASI-2026-0006 | MEDIUM | 6.8 | In ntfs_name_decode of ntfs.c, the name_length field is read directly from the on-disk $FILE_NAME at... | 2026-07-20 |
| ASI-2026-0007 | MEDIUM | 5.9 | In ext2_vfs_readdir of ext2.c, a directory entry's name_len and rec_len fields are read directly fro... | 2026-07-20 |
| ASI-2026-0008 | MEDIUM | 5.9 | In xfs_vfs_readdir of xfs.c, the XFS_DINODE_FMT_LOCAL (shortform directory) code path parses on-disk... | 2026-07-20 |
| ASI-2026-0009 | HIGH | 7.1 | In the M4A demuxer of m4a_demux.c, the first_chunk field of an stsc box entry is read directly from ... | 2026-07-20 |
| ASI-2026-0010 | MEDIUM | 5.9 | In the btrfs mount routine of btrfs.c, the sys_chunk_array_size field of an on-disk btrfs superblock... | 2026-07-20 |
| ASI-2026-0011 | MEDIUM | 5.5 | In the MP3 decoder of mp3_decoder.c, a raw 5-bit region-address field (value range 0-31) read direct... | 2026-07-20 |
| ASI-2026-0012 | HIGH | 8.1 | In recv_record of tls.c, the 16-bit record-length field of an incoming TLS record is validated only ... | 2026-07-20 |
| ASI-2026-0013 | MEDIUM | 5.5 | In keyboard_poll() of keyboard.c, an unconditional sti at the end of the function re-enabled maskabl... | 2026-08-14 |
| ASI-2026-0014 | HIGH | 8.4 | syscall_handler() in syscall.c ignores the page tables' PTE_USER bit entirely once execution reaches... | 2026-08-14 |
| ASI-2026-0015 | MEDIUM | 6.8 | In fmt_num() of editors/awk.c in BusyBox's awk applet, the user-controllable OFMT and CONVFMT awk va... | 2026-09-01 |