Skip to content
← All distributions

Updated 00:01

Determinate Secure Packages distribution

secure-packages-rollingSupportedFIPS supportedContinuous

Built on Nixpkgs as it moves. Available for use in production environments and covered by our standard service-level agreement (SLA).

Fixed within SLA

210

last 30 days

Fixed within SLA

24

last 7 days

Open

27

not yet fixed but still within SLA

Overdue

0

open

Missed SLA

0

last 30 days

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Email sales@determinate.systems

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}
FIPS variant

FIPS variantflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}

In the FIPS variant, every covered package is compliant with Federal Information Processing Standards (FIPS). Using the FIPS variant has the details.

237 CVEs tracked

CVEStatusSeveritySummaryClock startedDeadlineFixedTime to fix
Fixed within SLAHighi2c core adapter registration race causes i2c_get_adapter to access uninitialized device, NULL/UAFAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACriticalUse-after-free via IDR leak and uninitialized delayed_work on nfsd layout setlease failureAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLACriticalNFSD: SECINFO_NO_NAME decode leaves stale sin_exp; exp_put called after truncated XDRAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighnfsd: posix_acl memory leak when SETACL decode fails; pc_release didn't free ACLsAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighLinux nfsd4_create_file ignores ACL conversion errors; leaks posix_acl allocationsAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighDead ACL conflict guard in nfsd4_create leaks posix_acls, causing unbounded slab exhaustionAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighnfsd memory leak: pre-allocated openowner overwritten during unconfirmed owner retry raceAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumnfsd fails to reset write verifier on deferred writeback errors, causing COMMIT data lossAug 4, 2026Sep 18, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4/flexfiles accepts zero fh_count, causing ZERO_SIZE_PTR and KASAN null dereferenceAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4/pNFS: zero-length r_addr triggers NULL pointer dereference in nfs4_decode_mp_ds_addrAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighksmbd: OOB read in smb_check_perm_dacl due to ACE/SID length mismatchAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighUse-after-free in TCP-AO del_async due to dangling current_key/rnext_key on LISTEN socketsAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAHighLinux kernel IPv4 __ip_append_data paged allocation miscalculates fraggap, causing undersized linear area, overstated pagedlenJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighUnprivileged IPv6 UDP fraggap misaccounting overflows skb in paged allocation using MSG_SPLICE_PAGESJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighaf_unix race: unix_gc may run with gc_in_progress false, breaking MSG_PEEK safetyJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighKVM x86 shadow paging UAF due to child page role mismatch after PDE changeJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAHighqdisc_pkt_len_segs_init fails to pull GSO headers, risking memcpy issues in TSO driversJul 27, 2026Aug 11, 2026Aug 7, 202611 days
Fixed within SLAHighBPF verifier misses ld_{abs,ind} failure path analysis in subprograms, mishandling abnormal exitsJul 27, 2026Aug 11, 2026Aug 7, 202611 days
Fixed within SLAHighSame-register dst/src in BPF sock_ops leaves dst unzeroed, causing OOB read and leakJul 23, 2026Aug 7, 2026Aug 7, 202615 days
Fixed within SLAMediumMissing run load for vcn0 across segments in ntfs3 attr_data_get_block_locked causes SPARSE_LCN WARN_ONJul 20, 2026Sep 3, 2026Aug 7, 202618 days
Fixed within SLAMediumDRM/TTM ttm_bo_shrink() infinite LRU walk on backup failureJul 16, 2026Aug 30, 2026Aug 7, 202622 days
Fixed within SLAMediumrtw88 8821CE probe crash when pci_upstream_bridge() returns NULL on root busJun 27, 2026Aug 11, 2026Aug 7, 202641 days
Fixed within SLAMediumnf_tables reset commit_mutex causes circular lock with ipset list and iptables-nft '-m set'Jun 26, 2026Aug 10, 2026Aug 7, 202643 days
Fixed within SLAMediumChrome DevTools untrusted input allows remote bypass of navigation restrictions via crafted HTMLAug 4, 2026Sep 18, 2026Aug 5, 20261 day
Fixed within SLAHighChrome Chromoting on Linux <151.0.7922.72 allows OS-level privilege escalation via network trafficAug 4, 2026Aug 19, 2026Aug 5, 20261 day
Fixed within SLAHighLinux kernel Greybus raw cdev close use-after-free after bundle disconnect causes refcount underflowJul 20, 2026Aug 4, 2026Jul 30, 202610 days
Fixed within SLAHighGreybus raw: use-after-free on write after disconnect causes kernel panicJul 20, 2026Aug 4, 2026Jul 30, 202610 days
Fixed within SLAHighice driver double-free of tx_buf skb after tso/csum failure and interface downJul 16, 2026Jul 31, 2026Jul 30, 202614 days
Fixed within SLAHighSOCKMAP redirect hides inflight FDs from AF_UNIX GC, causing leaks and use-after-freeJul 16, 2026Jul 31, 2026Jul 30, 202614 days
Fixed within SLAHighnf_tables hook list update RCU race breaks netlink dump traversal during ruleset updatesJul 16, 2026Jul 31, 2026Jul 30, 202614 days
Fixed within SLAHighCeph writeback path leaks folio references for folios not suitable for writebackJul 16, 2026Jul 31, 2026Jul 30, 202614 days
Fixed within SLAHighlibceph __ceph_x_decrypt() OOB read if buffer smaller than ceph_x_encrypt_headerJul 16, 2026Jul 31, 2026Jul 30, 202614 days
Fixed within SLAMediumKVM nSVM ignores L1 CR3 restore failure on nested #VMEXIT, corrupting vCPU stateJun 19, 2026Aug 3, 2026Jul 30, 202641 days
Fixed within SLAMediumDeferred split queue race during migration makes dst visible early, triggering WARN and folio lossJun 19, 2026Aug 3, 2026Jul 30, 202641 days
Fixed within SLAMediummm/damon: damos_walk and kdamond exit race causes deadlock with infinite request waitJun 19, 2026Aug 3, 2026Jul 30, 202641 days
Fixed within SLAMediumASoC nau8821: Unloading driver with pending jdet_work causes kernel crashJun 17, 2026Aug 1, 2026Jul 30, 202643 days
Fixed within SLAMediumgfs2_fill_super leaks kernel threads and quota bitmap on read-write transition failureJun 17, 2026Aug 1, 2026Jul 30, 202643 days

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Email sales@determinate.systems