CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...

CVE-2026-89479

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the kernel attempts to access memory that has already been...

CVE-2026-89585

A flaw was found in the auxdisplay: charlcd component of the Linux kernel. This use-after-free vulnerability occurs when the charlcdregister function fails, leading to the charlcd object being freed while a delayed work item still retains its address. A local attacker could potentially exploit th...

CVE-2026-89670

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. A race condition exists in the nfsdopenlocalfh function where an nfsdfile object can be freed and its memory recycled while another process attempts to access it. This can lead to a use-after-free vulnerability,...

CVE-2026-89455

A flaw was found in the Linux kernel's PCI PLDA driver. During the teardown of Interrupt Request IRQ domains, the system can attempt to access memory that has already been freed. This 'use-after-free' vulnerability occurs because the domain's internal data is released before all associated IRQs a...

CVE-2026-89750

A flaw was found in the Linux kernel's tracing/userevents component. This vulnerability arises when a child process, created via fork, exits and frees memory that the parent process still references. This creates a Use-After-Free UAF condition, where the parent process attempts to access freed...

CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbtaltmoderemove function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-89738

A flaw was found in the Linux kernel's at91udc USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering a normal driver unbind operation, which may interleave with ...

CVE-2026-80950

A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but before the interrupt handler is aware, it can attempt to...

CVE-2026-80975

A flaw was found in the Linux kernel's qnap-mcu driver. This vulnerability occurs when the driver processes commands and a reply from the Microcontroller Unit MCU arrives after a command has timed out or failed. The driver may write this late or unsolicited message into a memory area that is no...

CVE-2026-80932

A flaw was found in the Linux kernel, specifically within the vsock/virtio component. An incorrect order of flushing work items during the removal of a virtiovsock object can lead to a use-after-free condition. This vulnerability allows a race condition where memory can be freed while still in us...

CVE-2026-89675

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

CVE-2026-89746

A flaw was found in the Linux kernel's tracing component. A local user can exploit a use-after-free vulnerability by registering multiple histogram triggers with the same name. This action causes the kernel to attempt to access freed memory, leading to a system crash and a Denial of Service DoS...

CVE-2026-89733

A flaw was found in the Linux kernel's USB Video Class UVC gadget driver. This vulnerability occurs in the uvcfunctionbind and uvcfunctionunbind functions, where pointers to freed memory are not properly cleared. This can lead to a use-after-free UAF condition, potentially allowing an attacker to...

CVE-2026-89712

A flaw was found in the Linux kernel's Network File System Daemon NFSD component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, another NFS Remote Procedure Call RPC thread can free memory that...

CVE-2026-81001

A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP driver. A race condition in the slsync function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after it has been freed. A local attacker could exploit this to cause a...

CVE-2026-89663

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...

CVE-2026-89709

A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvcops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow a local attacker to cause a denial of service...

CVE-2026-89485

A flaw was found in the lockd component of the Linux kernel. This use-after-free vulnerability occurs in the nlmtraversefiles function when a file's memory is prematurely released while an iterator still holds a pointer to it. A remote attacker could potentially exploit this to cause system...

CVE-2026-80979

A flaw was found in the Linux kernel's Shared Memory Communications SMC component. During connection termination, the SMC component may fail to properly unregister a connection before draining its receive tasklet. This can lead to a use-after-free vulnerability, where a freed memory buffer is...