Security update for iperf

This update for iperf fixes the following issues: CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion bsc1284405. CVE-2026-71218: unbounded peer-controlled allocation in JSONread allows unauthenticated remote...

SUSE-SU-2026:4678-1 Security update for iperf

This update for iperf fixes the following issues: - CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion bsc1284405. - CVE-2026-71218: unbounded peer-controlled allocation in JSONread allows unauthenticated remot...

CVE-2026-101308

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

EUVD-2026-101883

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101308

The sound(4) driver in FreeBSD contains a TOCTOU (Time-of-Check Time-of-Use) race condition during audio channel buffer resizing. The driver checks if a buffer is memory-mapped, drops the channel lock to allocate a new buffer, and then frees the old one. A concurrent mmap(2) call can complete dur...

CLEANSTART-2026-ZA04816 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: NFSD: Prevent client use-after-free during blocked-lock reaping

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port

A flaw was found in the Linux kernel's bridge multicast functionality. Improper management of multicast contexts when a bridge port is removed can lead to a use-after-free vulnerability. This issue could allow a local attacker to cause a system crash, resulting in a denial of service...

kernel: nfsd: don't free session slots that are still in use

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. A remote attacker could exploit a use-after-free vulnerability in the nfsd4sequence function. This occurs when the system attempts to reduce the number of active session slots while a client is still using one of the slo...

RLSA-2026:80512 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authenticatio...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

cairo:font_fuzzer: Heap-double-free in bdf_free_font

Detailed Report: https://oss-fuzz.com/testcase?key=5997915466956800 Project: cairo Fuzzing Engine: afl Fuzz Target: fontfuzzer Job Type: aflasancairo Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x79ec2b4e0740 Crash State: bdffreefont BDFFaceDone destroyface Sanitizer: address...

X.Org Server XInput Passive Grab Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...