136642 matches found
CVE-2026-68201
ALSA timer use-after-free in the Linux kernel (CVE-2026-68201): when a master timer is closed, the slaves’ callbacks could still be running and be freed underneath them. The fix drains the slaves’ callbacks before remove_slave_links(), removes slaves from the ack list, and waits for in-flight cal...
CVE-2026-68200
In the Linux kernel, the following vulnerability has been resolved: A...
EUVD-2026-55301
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...
CVE-2026-68200
The Linux kernel ALSA timer vulnerability CVE-2026-68200 allows a use-after-free when a utimer callback is still running and a second interrupt re-queues the same instance. The fix prevents re-queuing an in-flight callback by not adding it (and its slaves) to the ack/sack list while the callback ...
CVE-2026-68199
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68198
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68198
The CVE describes a use-after-free in Linux kernel ath6kl wifi (aggr_reset_state) related to the non-synchronous timer_delete() used for the aggregation timer. If the aggr_timeout callback is running when aggr_reset_state() executes, it may access aggr_conn fields (e.g., rx_tid, stat) that can be...
EUVD-2026-55299
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like...
CVE-2026-68197
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68196
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68195
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68194
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68193
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68192
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68192
The CVE concerns the Linux kernel driver brcmfmac (wifi). The issue arises in brcmf_pcie_release_scratchbuffers() where DMA buffers (shared.scratch and shared.ringupd) are freed with dma_free_coherent() but pointers are not cleared, unlike release_ringbuffers(). If reset teardown runs before remo...
CVE-2026-68191
In the Linux kernel, the following vulnerability has been resolved: w...
CVE-2026-68190
In the Linux kernel, the following vulnerability has been resolved: s...
EUVD-2026-55290
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...
CVE-2026-68189
The Linux kernel Bluetooth hci_sync path had a serialization gap in UUID list handling. While generating and committing class-of-device and EIR data, the code did not serialize access to hdev->uuids against add_uuid()/remove_uuid(), allowing interleaving that caused a use-after-free (KASAN) in...