Use-after-free through `init_using_cdict` and `init_using_ddict`

CCtx::initusingcdict and DCtx::initusingddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...

RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

CCtx::tryclone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wro...

Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

CCtx::tryclone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wro...

RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream

The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompressusingdict could leave the context pointing at the dictionary borrowed for that call, and the next...

PT-2026-125061

CCtx::try clone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy...

PT-2026-125059

The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompress using dict could leave the context pointing at the dictionary borrowed for that call, and the next...

PT-2026-125058

CCtx::init using cdict and DCtx::init using ddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...

Linux Distros Unpatched Vulnerability : CVE-2026-31730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - misc: fastrpc: possible double-free of cctx-remoteheap fastrpcinitcreatestaticprocess may free cctx-remoteheap on the errmap path but does not clear the pointer...

CVE-2026-31730

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx-remoteheap fastrpcinitcreatestaticprocess may free cctx-remoteheap on the errmap path but does not clear the pointer. Later, fastrpcrpmsgremove frees cctx-remoteheap again if it is...

CVE-2026-31730: Double Free

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx-remoteheap fastrpcinitcreatestaticprocess may free cctx-remoteheap on the errmap path but does not clear the pointer. Later, fastrpcrpmsgremove frees cctx-remoteheap again if it is...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a possible double deallocation of cctx-remoteheap in the fastrpc mechanism, potentially leading t...