CVE-2026-90198

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture core. A local user could exploit a use-after-free vulnerability when a sound card is unbound while a user-space application still holds an open file descriptor. This race condition allows the system to attempt to access...

CVE-2026-90189

A flaw was found in the Linux kernel's nullblk component. A race condition can occur when the configfs subsystem is registered before default devices are created. This allows a local attacker, by performing a specific sequence of operations, to trigger a Use-After-Free UAF vulnerability. This cou...

CVE-2026-90180

A flaw was found in the Linux kernel's mtip32xx block device driver. A local user with access to an already open block device could exploit a synchronization issue between ioctl handlers and device removal. This could lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-90173

A flaw was found in the Linux kernel's SMB Direct smbdirect component. This vulnerability occurs because the system attempts to access memory that has already been freed when handling network communication. A remote attacker could exploit this timing issue, potentially leading to system instabili...

CVE-2026-90171

A flaw was found in the SMB Direct smbdirect component of the Linux kernel. This vulnerability arises from an improper handling of child sockets during the shutdown process, where memory is released prematurely while still in use. A remote attacker could potentially exploit this timing issue to...

CVE-2026-90162

A flaw was found in ksmbd, a kernel module for SMB3 protocol support in the Linux kernel. A race condition exists in the smb2lock function, where a lock object can be freed while still being referenced, known as a Use-After-Free, and then freed again, known as a Double-Free. This occurs when...

CVE-2026-90151

A flaw was found in the Linux kernel's Network File System version 4 NFSv4 component. This vulnerability occurs when an NFSv4 client allocation fails, leaving a stale pointer to a freed client. A local attacker could potentially exploit this use-after-free condition by triggering a callback looku...

DEBIAN-CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

DEBIAN-CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

DEBIAN-CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109945

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...

CVE-2026-109943

FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

Windows DHCP Server Remote Code Execution Vulnerability

Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network...

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Use after free in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to elevate privileges locally...