Acer Care Center 安全漏洞

Acer Care Center is a system care center from Acer China that allows you to back up or restore your system settings and network drivers to prevent the effects of a system failure. A security vulnerability exists in Acer Care Center that stems from a Named Pipe created by the ACCSvc service that h...

GHSA-4G75-9R48-JF92 ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met...

ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met...

EUVD-2026-31272

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Disallow re-exporting imported GEM objects Prevent re-exporting of imported GEM buffers by adding a custom primehandletofd callback that checks if the object is imported and returns -EOPNOTSUPP if so. Re-exporting...

CVE-2026-45251

A file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, t...

CVE-2026-39461

libcasper3 communicates with helper processes via UNIX domain sockets, and uses the select2 system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select2's descriptor set size limit of FDSETSIZE 1024. An attacker able to cause an...

CVE-2026-39461 select(2) file descriptor set overflow causes stack overflow

libcasper3 communicates with helper processes via UNIX domain sockets, and uses the select2 system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select2's descriptor set size limit of FDSETSIZE 1024. An attacker able to cause an...

CVE-2026-39461

A stack corruption vulnerability exists in libcasper(3) on FreeBSD due to a lack of verification that socket descriptors fit within the select(2) system call's FD_SETSIZE limit (1024). An attacker can trigger this by causing an application to allocate a large number of file descriptors, for examp...

CVE-2026-39461 select(2) file descriptor set overflow causes stack overflow

libcasper3 communicates with helper processes via UNIX domain sockets, and uses the select2 system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select2's descriptor set size limit of FDSETSIZE 1024. An attacker able to cause an...

libusb: libusb: Denial of Service via malformed USB configuration descriptor

A flaw was found in libusb. An attacker can provide a specially crafted Universal Serial Bus USB configuration descriptor to applications using libusb. This malformed descriptor can lead to a null pointer dereference, causing the application to crash and resulting in a denial of service. This...

CVE-2026-45251 Kernel use-after-free via file descriptor syscalls

A file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, t...

CVE-2026-45251

A file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, t...

EUVD-2026-31256

A file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, t...

CVE-2026-45251

A use-after-free vulnerability exists in the FreeBSD kernel. A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call. Because the blocked thread does not hold a reference to the underlying object, the kernel may free the object while the thread remains blocked. In...

CVE-2026-45251 Kernel use-after-free via file descriptor syscalls

A file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, t...

PT-2026-42397

Name of the Vulnerable Software and Affected Versions FreeBSD libcasper3 affected versions not specified Description libcasper3 communicates with helper processes via UNIX domain sockets and utilizes the select2 system call to wait for available data. The software fails to verify if the socket...

PT-2026-42399

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free issue exists where a file descriptor can be closed while a thread is blocked in a poll2 or select2 call waiting for that descriptor. Since the blocked thread does not ho...

FreeBSD 资源管理错误漏洞

FreeBSD is a Unix-like operating system developed by the FreeBSD Foundation. There is a resource management vulnerability in FreeBSD. This vulnerability arises from threads being blocked during poll or select calls when file descriptors are closed. The kernel fails to remove the blocked threads...

FreeBSD 安全漏洞

FreeBSD is a Unix-like operating system developed by the FreeBSD Foundation. There is a security vulnerability in FreeBSD, which stems from the lack of verification that the socket descriptors are within the FDSETSIZE limit, potentially leading to stack corruption. If the target application runs...

PT-2026-42812

Name of the Vulnerable Software and Affected Versions ImageMagick affected versions not specified Description A race condition in the magick -distribute-cache service allows a remote attacker to hijack a file descriptor within the server process. Recommendations At the moment, there is no...