2621 matches found
CVE-2026-90201
CVE-2026-90201 is a Use-After-Free in the Linux kernel's net: page_pool subsystem. The bug occurs when page_pool_scrub() iterates pool->dma_mapped without holding a page reference concurrently with a page return via page_pool_put_netmem() on a different CPU. A losing xa_cmpxchg() caller frees ...
EUVD-2026-81782
In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...
CVE-2026-90162 ksmbd: defer publishing granted locks to prevent UAF/double-free race
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...
CVE-2026-90162
CVE-2026-90162 is a Use-After-Free and Double-Free race condition in the Linux kernel's ksmbd (in-kernel SMB server) component, specifically in smb2_lock(). Mid-batch granted locks are published to conn->lock_list and fp->lock_list immediately upon vfs_lock_file() success while also remaini...
CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit
In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...
EUVD-2026-81733
In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...
CVE-2026-90210: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpftrampolinemultiattachfree on update failure When bpftrampolineupdate fails before modifyfentrymulti/ unregisterfentrymulti is called, curimage is unchanged curimage == oldimage and ftrace still calls into it...
CVE-2026-93050: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...
CVE-2026-93117: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentati...
CVE-2026-90392: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...
CVE-2026-90045
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...
CVE-2026-90045
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...
DEBIAN-CVE-2026-89774
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...
kernel security update
An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...
RHEL 9 : kernel-rt (RHSA-2026:67721)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67721 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...
RHEL 9 : kernel (RHSA-2026:67723)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67723 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nftsetpipapoavx2:...
RockyLinux 8 : kernel-rt (RLSA-2026:67469)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67469 advisory. kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address...
bwslop
p2jb / poopsploit — PS5 WebKit exploit host Static site. Open...