PT-2026-35138

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Open vSwitch component of the Linux kernel. The ovs netdev tunnel destroy function may execute after the NETDEV UNREGISTER process has already detached the...

EUVD-2026-12856

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

UBUNTU-CVE-2026-23251

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

CVE-2026-23251 xfs: only call xf{array,blob}_destroy if we have a valid pointer

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

ROS-20260317-73-0001

A vulnerability in the kmemcachedestroy function of the dswstate.c module of the Linux operating systems kernel is related to the lack of memory release after an effective lifetime. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

PT-2026-34376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the xfrm iptfs component where the iptfs clone state function stores x-mode data before the reorder window is allocated. If this allocation fails, the system frees the...

Envoy: HTTP - filter chain execution on reset streams causing UAF crash

Note: This vulnerability was originally reported to the Google OSS VRP Issue ID: 477542544. The Google Security Team requested that I coordinate directly with the Envoy maintainers for triage and remediation. I am submitting this report here to facilitate that process. Technical Details I have...

PT-2026-24622

Note: This vulnerability was originally reported to the Google OSS VRP Issue ID: 477542544. The Google Security Team requested that I coordinate directly with the Envoy maintainers for triage and remediation. I am submitting this report here to facilitate that process. Technical Details I have...

CLSA-2026-1772793148 Fix CVE(s): CVE-2026-25795

SECURITY UPDATE: null pointer dereference and crash in image reading - debian/patches/CVE-2026-25795.patch: Fix NULL pointer dereference; move DestroyImageInfo call after filename copy; cause: DestroyImageInfo was called before filename copy, freeing readinfo used to access filename. -...

The vulnerability of the user_dlmdestroy_lock() function in the fs/ocfs2/dlmfs/userdlm.c module of the OCFS2 file system support in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the userdlmdestroylock function in the fs/ocfs2/dlmfs/userdlm.c module of the OCFS2 file system support in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Oracle Linux 7 : kernel (ELSA-2026-1581)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1581 advisory. - e1000e: fix heap overflow in e1000seteeprom CVE-2025-39898 Orabug: 38904071 - i40e: fix idx validation in config queues msg CVE-2025-39971 Orabug:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005792)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005792 advisory. In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-005706)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005706 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy Dmcache also has the same UAF problem when dmresume and dmdestroy ar...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005705)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005705 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy Dmcache also has the same UAF problem when dmresume and dmdestroy ar...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005492 advisory. In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free...

The vulnerability of the destroy() function in the drivers/md/dm-cache-target.c file of the Linux operating system’s device driver framework for multiple devices (such as RAID and LVM) allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the destroy function in the drivers/md/dm-cache-target.c file of the Linux kernel driver for multiple device drivers such as RAID and LVM is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

GHSA-P33R-FQW2-RQMM ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

In ReadSFWImage coders/sfw.c, when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash. AddressSanitizer:DEADLYSIGNAL ================================================================= ==1414421==ERROR:...

CVE-2026-25795 ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in ReadSFWImage coders/sfw.c, when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereferen...

ROS-20260220-73-0029

A vulnerability in the EXPORTSYMBOL, destroycmid and cmworkhandler functions drivers/infiniband/core/iwcm.c of the Linux kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability could allow an attacker to escalate his privileges...

SUSE CVE-2026-23126

In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpfboundprogs list The netdevsim driver lacks a protection mechanism for operations on the bpfboundprogs list. When the nsimbpfcreateprog performs listaddtail, it is possibl...