118222 matches found
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
kernel: netfilter: ipset: fix race between dump and ip_set_list resize
A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
kernel: zram: fix use-after-free in zram_bvec_write_partial()
A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...
kernel: netfilter: ipset: fix race between dump and ip_set_list resize
A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...
CVE-2026-58093
CVE-2026-58093 is a use-after-free vulnerability in the FreeBSD kernel tty subsystem , specifically in the TIOCSCTTY ioctl handler. The handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the tty lock, allowing it to link a con...
CVE-2026-58093 Kernel use-after-free via tty ioctls
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58090
The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
CVE-2026-58091
CVE-2026-58091 is a kernel use-after-free in FreeBSD's sound(4) driver , triggered via the SNDCTL_DSP_SYNCSTART ioctl. When locking a channel in a sync group would block, the implementation releases the sync group list lock and sleeps; upon reawakening, the sync group structure may have been free...
EUVD-2026-66236
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
EUVD-2026-66235
The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...
CVE-2026-58090 Use-after-free in unix SOCK_STREAM message handling
The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...
CVE-2026-58090
CVE-2026-58090 is a use-after-free in FreeBSD 's core unix module, affecting FreeBSD 15.0 and later . The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing; certain error paths would free those messages, lea...
kernel: netfilter: ipset: fix race between dump and ip_set_list resize
A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...