kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

kernel: netfilter: ipset: fix race between dump and ip_set_list resize

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

CVE-2026-58093

CVE-2026-58093 is a use-after-free vulnerability in the FreeBSD kernel tty subsystem , specifically in the TIOCSCTTY ioctl handler. The handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the tty lock, allowing it to link a con...

CVE-2026-58093 Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-58090

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58091

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58091

CVE-2026-58091 is a kernel use-after-free in FreeBSD's sound(4) driver , triggered via the SNDCTL_DSP_SYNCSTART ioctl. When locking a channel in a sync group would block, the implementation releases the sync group list lock and sleeps; upon reawakening, the sync group structure may have been free...

EUVD-2026-66236

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58090 Use-after-free in unix SOCK_STREAM message handling

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

EUVD-2026-66235

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090

CVE-2026-58090 is a use-after-free in FreeBSD 's core unix module, affecting FreeBSD 15.0 and later . The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing; certain error paths would free those messages, lea...

kernel: netfilter: ipset: fix race between dump and ip_set_list resize

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

SUSE CVE-2026-72499

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

PT-2026-82124

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvlan module where devices inherit hard header len from phy dev during ipvlan init but fail to inherit needed headroom and needed tailroom, leaving them set to 0...