CVE-2026-68192

The CVE concerns the Linux kernel driver brcmfmac (wifi). The issue arises in brcmf_pcie_release_scratchbuffers() where DMA buffers (shared.scratch and shared.ringupd) are freed with dma_free_coherent() but pointers are not cleared, unlike release_ringbuffers(). If reset teardown runs before remo...

CVE-2026-68189

The Linux kernel Bluetooth hci_sync path had a serialization gap in UUID list handling. While generating and committing class-of-device and EIR data, the code did not serialize access to hdev->uuids against add_uuid()/remove_uuid(), allowing interleaving that caused a use-after-free (KASAN) in...

CVE-2026-68188

CVE-2026-68188 : In the Linux kernel Bluetooth RFCOMM path, a race caused use-after-free in rfcomm_send_rpn when rfcomm_tty_set_termios tests dlc->session without holding rfcomm_mutex and the DLC/session is freed by krfcommd. The fix adds rfcomm_dlc_send_rpn() that holds rfcomm_mutex while ver...

CVE-2026-68181

In the Linux kernel, CVE-2026-68181 affects the mei bus cleanup path. The vulnerability arises in mei_cl_bus_dev_release() where mei_cl_flush_queues() runs without holding a lock, and subsequent access to bus->file_list after mei_dev_bus_put(bus) can lead to a use-after-free if it was the last...

CVE-2026-68177

The CVE-2026-68177 issue affects the Linux kernel tracing subsystem, specifically the delay of module refcount release for the "enable_event" trigger. The root cause was that the module refcount was released immediately while the enable_event data could still be accessed after module removal, cre...

CVE-2026-68169

The CVE-2026-68169 entry documents a race in Linux kernel mptcp_pm_userspace_get_local_id() where an address entry is looked up under a spinlock but its id is read after the lock is released, allowing a concurrent delete to free the entry and cause a use-after-free. Concrete details show the issu...

CVE-2026-68156

The CVE concerns the Linux kernel’s libceph integration. The issue arises in ceph_x_update_authorizer(): when a newer service ticket triggers a rebuild of the authorizer, the code may allocate a new buffer but fail to refresh the cached pointers in auth->authorizer_buf and auth->authorizer_...

CVE-2026-68152

The vulnerability CVE-2026-68152 affects the Linux kernel AMT support. A use-after-free can occur when an AMT device is removed: pending delayed works may access the freed amt_dev structure, risking kernel crashes or memory corruption. The race arises because amt_dev_stop() cancels delayed works ...

CVE-2026-68148

Summary: CVE-2026-68148 fixes a use-after-free in fscrypt by adding a missing super_block pointer comparison when locating fscrypt_direct_key entries. Previously, inodes with different super_blocks could share the same fscrypt_direct_key, allowing the key’s lifetime to outlive its super_block. Im...

CVE-2026-68147

Summary (CVE-2026-68147) In the Linux kernel, the fscrypt subsystem fixed a dynamic allocation pitfall in fscrypt_get_devices(), which gathers the filesystem’s block-device list to apply config/start/evict calls. The vulnerability arose because the device pointers were stored in a dynamically all...

CVE-2026-68144

The CVE-2026-68144 issue affects the Linux kernel Phonet (pep) stack, where pep_get_sb() may dereference a stale skb pointer after pskb_may_pull() relocates skb data, leading to a use-after-free. The vulnerability manifests as a KASAN slab-use-after-free in pep_get_sb+0x234/0x3b0, traced through ...

CVE-2026-68140

CVE-2026-68140 pertains to the Linux kernel net/iucv path handling. The root cause is a use-after-free of a severed iucv_path: af_iucv queues not-yet-received message notifications that hold raw pointers to iucv_path; when the peer severs, iucv_path_free() frees the path but notifications remain ...

CVE-2026-68137

The CVE-2026-68137 entry concerns the Linux kernel net/x25 subsystem and a use-after-free in x25_kill_by_neigh(). The flaw arises when walking the global X.25 socket list under x25_list_lock and then dropping the lock before locking the socket with lock_sock(s). A concurrent close can remove the ...

CVE-2026-68127

The CVE describes a slab-use-after-free in the Linux kernel’s ila_update_ipv6_locator() triggered by a non-linear skb and pskb_may_pull() in the csum_adjust_transport path. The root cause is that ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before pskb_may_pull(), and __pskb_pull_tail(...

CVE-2026-68126

The CVE-2026-68126 vulnerability affects the Linux kernel mac802154 path by dereferencing the scanned sub-interface (sdata->dev) after the RCU read unlock and after the rtnl is dropped, leading to a use-after-free when DEL_INTERFACE or PHY removal unregisters the interface. The root cause is t...

CVE-2026-68117

In the Linux kernel TIPC subsystem, CVE-2026-68117 is resolved by clearing sock->sk on the failed-insert path in tipc_sk_create(). When tipc_sk_insert() fails, sk_free(sk) previously left sock->sk dangling, allowing a use-after-free during accept(). The root cause is that tipc_release() cou...

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-64564

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: libceph: fixed a potential use-after-free in havemonandosdmap The wait loop in cephopensession can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both cephmonchandlemap and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: netpoll: Fix incorrect refcount handling causing improper cleanup The commit efa95b01da18 “netpoll: fix use after free” incorrectly ignored the refcount and prematurely set dev-npinfo to NULL during netpoll cleanup,...