kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the rxemmap function, which manages memory for Remote Direct Memory Access RDMA operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resultin...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

kernel: ice: fix double-free of tx_buf skb

A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: zram: fix use-after-free in zram_bvec_write_partial()

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...

kernel: ALSA: 6fire: fix use-after-free on disconnect

A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory...

kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()

A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

CVE-2026-106269

An use after free flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=565742178 https://code.google.com/p/chromium/issues/detail?id=106269...

openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

uaf-2023-28205

CVE-2023-28205: Apple WebKit 사용 후 해제Use-After-Free 취약점 이 취약점은 악의적으로 제작된 웹 콘텐츠를 통해 악용될 수 있으며, 공격자가 임의 코드를 실행할 수 있게 합니다. 설명 코드는 Map 및 Date 객체의 추가를 지연시켜 가비지 컬렉터GC가 이를 해제하도록 함으로써 use-after-freeUAF 취약점을 유발합니다. 이는 잠재적으로 해제된 객체에 접근하여 메모리 손상을 일으키거나 익스플로잇을 가능하게 할 수 있습니다. 참조 WebKit Commit...

GhostLock

GhostLock - CVE-2026-43499 ローカル権限昇格エクスプロイト 脆弱性の概要 CVE 番号： CVE-2026-43499 脆弱性タイプ： futex PI（優先度継承）スタック UAF（Use-After-Free） 影響範囲： Linux カーネル 6.1 6.12（Android GKI） 利用効果： ローカル権限昇格 + SELinux 無効化、root シェル取得 動作原理 脆弱性トリガーパス 用户空间 → pselect → 内核栈上分配 rtmutexwaiter → futex PI 操作触发 waiter 释放 → 释放后的 waiter 内存被...

kernel-CTF

内核 CTF 挑战 一系列用于学习内核安全概念的 Linux 内核漏洞利用挑战。 环境要求 Linux 系统（已在 Ubuntu 上测试） 构建工具（gcc、make） 与你的内核版本匹配的 Linux 头文件 sudo apt-get update sudo apt-get install build-essential linux-headers-$uname -r 挑战内容 第 1 关：基础缓冲区溢出 内核模块漏洞利用入门 简单的缓冲区溢出漏洞 适合初学者的起点 位于 /level1 目录 第 2 关：释放后使用 更高级的内核漏洞利用 笔记系统中的释放后使用漏洞 介绍内核堆的概念 ...

Linux Distros Unpatched Vulnerability : CVE-2026-106291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...