CVE-2026-90337

A flaw was found in the Linux kernel's serial core component. This vulnerability occurs when the system attempts to allocate resources for a serial port after the console has been registered. If this allocation fails, the driver may improperly handle the port, leading to memory corruption issues...

CVE-2026-90321

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. Improper validation of inline extended attributes xattrs during inode block validation can lead to a use-after-free vulnerability. A local attacker could exploit this by providing specially crafted file system...

CVE-2026-90326

A flaw was found in the Linux kernel's blk-cgroup component. A race condition exists between the activation of an I/O scheduler policy and the destruction of a block group blkg. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated, and memory lea...

CVE-2026-90201

A flaw was found in the Linux kernel's pagepool networking component. A race condition can occur when the pagepooldestroy function runs concurrently with page return operations. This race condition can lead to a Use-After-Free UAF vulnerability, where the system attempts to access memory after it...

CVE-2026-90214

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Xilinx formatter Pulse-Code Modulation PCM driver. During the opening of an audio stream, memory allocated for stream data is not properly released if an error occurs in a subsequent step. This can...

CVE-2026-90210

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This use-after-free UAF vulnerability occurs when the bpftrampolineupdate function fails during an update operation. This failure can lead to a previously freed memory region being accessed, potentially resulting in syst...

CVE-2026-90204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. A local attacker could exploit a vulnerability where a corrupted filesystem metadata entry, specifically an append-DIO dinode, contains an out-of-range orphan slot value. The OCFS2 dinode validator fails to...

CVE-2026-104192 DragonflyDB stream RDB deserialization double-free

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdbload.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry ...

CVE-2026-104192

Prior to version 1.40 , the Dragonfly in-memory data store is vulnerable to a double-free issue in OpaqueObjLoader::CreateStream within src/server/rdb_load.cc. The flaw occurs when one streamNACK is associated with both a consumer group's global PEL and a consumer-local PEL; the system frees the ...

CVE-2026-90198

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture core. A local user could exploit a use-after-free vulnerability when a sound card is unbound while a user-space application still holds an open file descriptor. This race condition allows the system to attempt to access...

CVE-2026-90189

A flaw was found in the Linux kernel's nullblk component. A race condition can occur when the configfs subsystem is registered before default devices are created. This allows a local attacker, by performing a specific sequence of operations, to trigger a Use-After-Free UAF vulnerability. This cou...

CVE-2026-90180

A flaw was found in the Linux kernel's mtip32xx block device driver. A local user with access to an already open block device could exploit a synchronization issue between ioctl handlers and device removal. This could lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-90173

A flaw was found in the Linux kernel's SMB Direct smbdirect component. This vulnerability occurs because the system attempts to access memory that has already been freed when handling network communication. A remote attacker could exploit this timing issue, potentially leading to system instabili...

CVE-2026-90171

A flaw was found in the SMB Direct smbdirect component of the Linux kernel. This vulnerability arises from an improper handling of child sockets during the shutdown process, where memory is released prematurely while still in use. A remote attacker could potentially exploit this timing issue to...

CVE-2026-90162

A flaw was found in ksmbd, a kernel module for SMB3 protocol support in the Linux kernel. A race condition exists in the smb2lock function, where a lock object can be freed while still being referenced, known as a Use-After-Free, and then freed again, known as a Double-Free. This occurs when...

CVE-2026-90151

A flaw was found in the Linux kernel's Network File System version 4 NFSv4 component. This vulnerability occurs when an NFSv4 client allocation fails, leaving a stale pointer to a freed client. A local attacker could potentially exploit this use-after-free condition by triggering a callback looku...

DEBIAN-CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

DEBIAN-CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...