CVE-2026-63979

A flaw was found in the Linux kernel's net/handshake component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from...

CVE-2026-63927

A flaw was found in the Linux kernel, specifically within the dwc2 USB driver. This vulnerability, known as a use-after-free, occurs when the system attempts to access memory that has already been released. This happens because a USB Request Block urb is incorrectly accessed after it has been...

Linux MPTCP pm_del_add_timer Heap Buffer Overflow DoS

The vulnerability of the mptcppmdeladdtimer function in the net/mptcp/pm.c module of the MPTCP protocol implementation in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

CVE-2026-64071 nvme-pci: fix use-after-free in nvme_free_host_mem()

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvmefreehostmem nvmefreehostmem frees dev-hmbsgt via dmafreenoncontiguous but never clears the pointer afterward. This leads to a use-after-free if nvmefreehostmem is called twice in the same error...

AZL-92910 CVE-2026-57076 affecting package perl-YAML-Syck 1.34-1

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor. In the bundled libsyck an anchor name allocated by syckstrndup is stored both as node-anchor, freed when the node is freed, and as the key in the parser's...

ROS-20260716-73-0047

The vulnerability of Google Chrome’s speech recognition function relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

JLSEC-2026-725 A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare...

A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography PQC hybrid KeyShare processing. In the error handling path of TLSXKeyShareProcessPqcHybridClient in src/tls.c, the inner function TLSXKeyShareProcessPqcClientex frees a KyberKey object upon encountering an error. The call...

hibmc_msi_init Heap Buffer Overflow DoS

The vulnerability of the hibmcmsiinit function in the drivers/gpu/drm/hisilicon/hibmc/hibmcdrmdrv.c driver for the Direct Rendering Infrastructure DRI component of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an...

Linux kernel Bluetooth L2CAP Buffer Overflow DoS

The vulnerability of the l2capdatachannel function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

NFS Client Buffer Overflow

The vulnerability of the nfs4openandgetstate function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux sch_ets Heap Buffer Overflow DoS

The vulnerability of the etsqdiscchange function in the net/sched/schets.c file, within the network scheduling subsystem of the Linux kernel, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux Ethernet Driver Buffer Overflow

The vulnerability of the functions qlcnic83xxinit drivers/net/ethernet/qlogic/qlcnic/qlcnic83xxinit.c and qlcnicprobe drivers.net/ethernet/qlogic/qlcnic/qlcnicmain.c in the Linux operating system’s Ethernet network adapter drivers is related to the reuse of previously freed memory. Exploiting thi...

Linux kernel multimedia driver Heap Buffer Overflow DoS

The vulnerability of the vidtvchannelsiinit function in the drivers/media/test-drivers/vidtv/vidtvchannel.c file of the Linux kernel multimedia device driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

Linux kernel drivers rapidio mport_cdev function heap buffer overflow DoS

The vulnerability of the mportcdevopen function in the drivers/rapidio/devices/riomportcdev.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

CVE-2025-59616

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory...

EUVD-2025-210437

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory...

CVE-2025-59616

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory...

Direct Rendering Infrastructure Kernel Driver Heap Buffer Overflow DoS

The vulnerability of the msmdrmuninit function in the driver/gpu/drm/msm/msmdrv.c file of the Direct Rendering Infrastructure DRI kernel driver of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to...

PT-2026-55986

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when processing multiple IOCTL Input/Output Control calls that use the same buffer file descriptor input. This issue is caused by a...

CVE-2026-9080

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...