CVE-2026-110602 libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

CVE-2026-110602

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

CVE-2026-110599 L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

EUVD-2026-101227

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

CVE-2026-110599

L-SMASH versions through 2.14.5 are vulnerable to a double free vulnerability within the hevc_setup_first_summary() and h264_setup_first_summary() functions located in importer/nalu_imp.c. The root cause is the improper freeing of borrowed codec-specific objects during error paths. An attacker ca...

CVE-2026-110599 L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe

L-SMASH through 2.14.5 contains a double free vulnerability in hevcsetupfirstsummary and h264setupfirstsummary in importer/naluimp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmashreadfile or the...

K000162608: NGINX ngx_http_core_module vulnerability CVE-2026-97205

Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing include virtual commands may trigger a Use-After-Free UAF...

EUVD-2026-101079

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98430

A vulnerability exists in the Linux kernel 's RDMA/efa driver where the management IRQ handler accessed the admin completion queue and async event queue before they were fully constructed or after they were destroyed. This occurs because the driver registered the IRQ while the queues were in an i...

CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, th...

CVE-2026-98429

The Linux kernel contains a vulnerability in the RDMA/efa subsystem where the completion IRQ handler accesses the EQ state and DMA buffer prematurely. The root cause is that the IRQ was registered before the state was initialized, and during teardown, the buffer was released before the handler wa...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

EUVD-2026-101064

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98415

The Linux kernel contains a use-after-free vulnerability within the soc: samsung: exynos-pmu driver. Specifically, the setup_cpuhp_and_cpuidle() function incorrectly decrements the reference count of the interrupt generation block node using of_node_put() immediately after fetching the resource a...

CVE-2026-98415

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98397

The Linux kernel contains a vulnerability in the platform/x86: x86-android-tablets driver. Specifically, in gpio_secondary_fwnode_init(), the acpi_bus_find_device_by_name() function returns a device reference that is dropped at the end of each iteration due to the __free(put_device) declaration. ...