757601 matches found
CVE-2026-110830 FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...
CVE-2026-110829 FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...
CVE-2026-110829
FreeRDP versions 3.0.0 through 3.31.x are vulnerable to a null pointer dereference within the rdpsnd channel . The root cause is triggered when a fragment sets the CHANNEL_FLAG_LAST flag without the CHANNEL_FLAG_FIRST flag. A malicious RDP server can exploit this by sending a malformed rdpsnd PDU...
CVE-2026-110829
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...
CVE-2026-110829 FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...
CVE-2026-110829
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...
CVE-2026-110829 FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...
kernel: wifi: mac80211: defer link RX stats percpu free to RCU
A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...
kernel: svcrdma: Reject Write/Reply chunks with segcount 0
A flaw was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access RPC-over-RDMA server component svcrdma. A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the...
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect
A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This vulnerability involves a race condition during the process of disconnecting a wireless device, where a work item can be improperly queued after it has been cancelled. This could allow a local attacker to trigger a system...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
A flaw was found in the KVM Kernel-based Virtual Machine component for ARM64 architecture in the Linux kernel. This vulnerability arises from a race condition within the virtual Generic Interrupt Controller vgic when an interrupt's processor affinity is changed at the same time its Locality-aware...
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups
A flaw was found in the Linux kernel's netfilter component, specifically within the nftlookup functionality. This issue arises from incorrect handling of 'catchall' elements during 'inverted lookups' in the nftlookupeval function. Due to a logic error where the lookup result is not recomputed,...
undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake
A flaw was found in undici. A malicious remote server can cause a Denial of Service DoS by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream ope...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: net/sched: cls_route: fix fastmap use-after-free on filter
A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...