CVE-2026-89942: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle's release function. If the device has...

CVE-2026-89997: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...

CVE-2026-90032: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm-privatedata. An open PCM file can outlive USB disconnect because usbtvaudiofree uses sndcardfreewhenclosed. The disconnec...

PT-2026-93488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the qla2xxx SCSI driver. The function qla2x00 async iocb timeout attempts to abort a timed-out asynchronous Input Output Control Block IOCB. When qla24xx...

CVE-2026-89847: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path scan...

PT-2026-93442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/nouveau/uvmm component. In the OP UNMAP SPARSE arm of the nouveau uvmm bind job submit function, the op-reg variable is assigned a value from...

PT-2026-93531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the go7007 media driver. The go7007 snd remove function releases the v4l2 device reference too early when a userspace process still has the capture PCM...

PT-2026-93581

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the iio dma fence implementation. The problem occurs because the implementation uses a lock embedded in iio dmabuf priv, but the iio dma fence can outliv...

PT-2026-93438

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ab8500 fg remove function. The driver destroys the workqueue while threaded interrupt handlers remain armed. Because these handlers are devm-managed...

PT-2026-93579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atlas-sensor driver within the industrial I/O IIO chemical subsystem. The driver uses devm request threaded irq to request hardware data-ready...

CVE-2026-89913: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

CVE-2026-92473: Use After Free

A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIFS Handler. The manipulation leads to use after free. The attack needs to be performed locally. The exploit is publicly available and migh...

PT-2026-93375

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.12.0 through 1.26.0 Description A use-after-free issue occurs when the software is compiled for DNS-over-HTTPs DoH support using the --with-libnghttp2 flag. During failure code paths, such as an RPZ drop query or...

PT-2026-93494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the qla2xxx SCSI driver. The function qla2x00 free fce trace frees and clears the ha-fce variable while holding only the fce mutex. However, the...

CVE-2026-89853: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

ROS-20260916-73-0073

The vulnerability of the bondmain.c component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-93370

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC DoQ support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output...

PT-2026-93679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd4 revoke export states function. The function drops the nn-client lock during the execution of revoke one stid and the subsequent read of clp-cl...

CVE-2026-90038: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...

CVE-2026-82720: Use After Free

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths i.e., RPZ drop query, jostle due to heavy traffic, a dropped DoH stream brings down the whole DoH session and does n...