EUVD-2026-81881

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure foreachchildofnodescoped releases the node reference on scope exit, so the explicit ofnodeputnp in the devmphycreate error path drops it twice. Drop the...

CVE-2026-90288

CVE-2026-90288 affects the Linux kernel driver phy: renesas: rcar-gen2. The root cause is a double of_node_put() on the PHY creation failure path: for_each_child_of_node_scoped() already releases the device-tree node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create(...

CVE-2026-90288 phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure foreachchildofnodescoped releases the node reference on scope exit, so the explicit ofnodeputnp in the devmphycreate error path drops it twice. Drop the...

EUVD-2026-81817

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

CVE-2026-90162 ksmbd: defer publishing granted locks to prevent UAF/double-free race

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

CVE-2026-90162 ksmbd: defer publishing granted locks to prevent UAF/double-free race

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

CVE-2026-90162

CVE-2026-90162 is a Use-After-Free and Double-Free race condition in the Linux kernel's ksmbd (in-kernel SMB server) component, specifically in smb2_lock(). Mid-batch granted locks are published to conn->lock_list and fp->lock_list immediately upon vfs_lock_file() success while also remaini...

EUVD-2026-81755

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

CVE-2026-90061

This Linux kernel netfilter nf_tables vulnerability occurs in both the dynset and newsetelem code paths. When no override expressions are provided for a new set element, the kernel clones the existing set expressions twice —once for the template and again for the new element—leading to a referenc...

CVE-2026-90061 netfilter: nf_tables: skip double clone set expressions on element insert

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip double clone set expressions on element insert Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This...

EUVD-2026-81922

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip double clone set expressions on element insert Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This...

kernel: dm_early_create: fix freeing used table on dm_resume failure

A flaw was found in the Linux kernel's device mapper DM subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result i...

redis: Redis: Remote Code Execution via specially crafted RESTORE payload

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

kernel: dm_early_create: fix freeing used table on dm_resume failure

A flaw was found in the Linux kernel's device mapper DM subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result i...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

EUVD-2026-81317

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop versions prior to v1.125.0 are affected by a double decoding flaw in the application's deeplink handler. An attacker can exploit this to load arbitrary same-origin content under a victim's active session, resulting in a Low integrity impact with no confidentiality or availability im...

CVE-2026-90224: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...