freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb

A heap buffer use after free has been discovered in FreeRDP. Asynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urbwritecompletion...

freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb

A heap buffer use after free has been discovered in FreeRDP. Asynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urbwritecompletion...

CVE-2026-23058

CVE-2026-23058 relates to a memory-leak in the Linux kernel can: ems_usb path. The description across sources states that URBs used for USB-in transfers are anchored in ems_usb_open() and submitted, but the USB framework can unanchor URBs before the complete callback, causing URBs to be released ...