PT-2026-93670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the realtek cr USB storage component. The realtek cr destructor function calls timer delete before the chip containing the timer is freed. This allows th...

ROS-20260916-73-0089

The vulnerability of the fstremoveone function in the drivers/net/wan/farsync.c file of the Linux kernel network device driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

ROS-20260916-73-0074

The vulnerability of the ab8500charger.c component in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260916-73-0068

The vulnerability of the hci/llcshdlc.c component in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260916-73-0028

The vulnerability of the buildidshow function in the drivers/xen/privcmd.c module of the Linux kernel device driver library is related to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

ROS-20260916-73-0010

The vulnerability of the hfscenqueue function in the net/sched/schhfsc.c component of the Linux kernel is related to the use of memory after it has been freed. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and cause service failures...

PT-2026-93597

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A locking issue exists in the s390/vfio-ap component when accessing the matrix dev-mdev list of ap matrix mdev objects. The vfio ap mdev probe function and the vfio ap mdev for queue...

PT-2026-93654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free condition exists in the tracing component. This occurs because options files do not take a trace array reference for the options they represent. If one task opens one of...

PT-2026-93642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the hid bpf ops destroy device and hid bpf unreg functions. This occurs because the coordination between device destruction and BPF link release uses a...

PT-2026-93601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the s390 vfio-ap component. In the vfio ap mdev set kvm function, the kvm-arch.crypto.pqap hook pointer is assigned before update locks are acquired and...

PT-2026-93643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free bug exists in the ftrace component. When the trace instance files set ftrace filter and set ftrace notrace are opened, a race condition occurs where the system attempts ...

PT-2026-93668

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the qcom-pmic-typec driver where cc debounce dwork is queued via set cc and start toggling callbacks. Because port stop returns before the TCPM kthread worker ...

PT-2026-93529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ov02a10 check hwcfg function. The function calls fwnode handle putep immediately after allocating and parsing the endpoint, but then attempts to use...

PT-2026-93928

Name of the Vulnerable Software and Affected Versions GPAC version 26.08-DEV Description A use after free flaw exists in the Proto Link Handler component within the gf inline get proto lib function of the src/compositor/mpeg4 inline.c file. A use after free is a memory corruption issue where an...

PT-2026-93663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the f midi2 USB gadget driver. The function f midi2 opts str show handles internal string locking, but its callers dereference the opts-info. pointer...

PT-2026-93679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd4 revoke export states function. The function drops the nn-client lock during the execution of revoke one stid and the subsequent read of clp-cl...

CVE-2026-92474: Use After Free

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

CVE-2026-92627: Use After Free

A heap-use-after-free vulnerability exists in H5Tconvff in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc is freed and subsequently read from within the same conversion...

CVE-2026-90045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...

CVE-2026-90044: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...