UBUNTU-CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

UBUNTU-CVE-2026-98472

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV V...

UBUNTU-CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

PT-2026-117666

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description Opening a specially crafted XCF file that selects a path and subsequently fails to load it can trigger a use-after-free condition in the main process. A use-after-free occurs when a program...

PT-2026-117665

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the XCF loader allows a dangling pointer to remain in the linked-channels list when a linked channel is destroyed through a selection property. A use-after-free occurs in the main...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

PT-2026-117566

A heap use-after-free in the gf odf ac4 cfg clean list function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-117534

A use-after-free in the gf filter pid get packet function filter core/filter pid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

ALSA-2026:85239 Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2025-55654

A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

CVE-2026-110681: Use After Free

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter...

CVE-2025-60482: Undefined Security Weakness

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2026-112094: Use After Free

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxmlloaddata of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The...

CVE-2026-112036: Double Free

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function freecharlist of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be use...

PT-2026-117171

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free char list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be...

PT-2026-117654

Name of the Vulnerable Software and Affected Versions Pillow versions 11.3.0 through 12.x Description A heap use-after-free occurs when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. This happens when an application saves attacker-influenced TIFF tags to BytesIO, causing...

UBUNTU-CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2025-60482

The GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap use-after-free vulnerability in the gf_odf_ac4_cfg_clean_list function located in /odf/descriptors.c. This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a crafted AC4 file . While the vul...

UBUNTU-CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

PT-2026-117660

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A double free of image memory can occur when the ImagingScaleAffine function encounters a selective allocation failure. This happens during the fast path processing of Transform.EXTENT or pure...