EUVD-2026-59129

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error...

PT-2026-72982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect big sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the...

CVE-2026-68126

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: espintcp: A race condition in espintcpclose has been fixed. This issue was discovered during a code audit. After espintcpclose is called, espintcptxwork can still be scheduled using functions like the Delayed ACK handler or...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.2.1 through 1.6.55, pngsettRNS and pngsetPLTE each act as aliases for a heap-allocated buffer between pngstruct and pnginfo. This buffer shares a...

CVE-2026-43632

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/counttokens that bypass the task queue and access ctxserver.vocab directly on HTTP...

CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/counttokens that bypass the task queue and access ctxserver.vocab directly on HTTP...

The vulnerability of the atmel_hlcdc_plane_atomic_duplicate_state() function in the driver/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c driver for the Direct Rendering Infrastructure (DRI) of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the atmelhlcdcplaneatomicduplicatestate function in the drivers/gpu/drm/atmel-hlcdc/atmelhlcdcplane.c driver of the Direct Rendering Infrastructure DRI infrastructure of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this...

nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling

A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Documentencoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a...

Linux Distros Unpatched Vulnerability : CVE-2026-64564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transpor...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-2038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2038 advisory. OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes CVE-2026-12932 When dynamic tls-crypt is active, it is possibl...

The vulnerabilities of the functions session_free(), hidp_session_remove(), and hidp_session_thread() in the net/bluetooth/hidp/core.c module of the Linux operating system’s Bluetooth subsystem allow a malicious actor to cause service failures.

The vulnerability of the functions sessionfree, hidpsessionRemove, and hidpSessionThread in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2026-64401

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a use-after-free, occurs when handling witness registrations. Specifically, a second mount for the same network share can cause the system to incorrectly reference a previously freed connection, leading to...

CVE-2026-64543

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A use-after-free vulnerability exists in the tipcdiscrcv function, where the discoverer object can be prematurely freed while still being referenced. An unprivileged local user can exploit this flaw by...

PT-2026-65564

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...

Siemens SIMATIC S7-1500 CPU 1518 MFP Race Condition within a Thread (CVE-2025-38681)

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdumpwalkpgd Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables...

SUSE CVE-2026-64491

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascamdisconnect cancels capturework and midiinwork before usbkillanchoredurbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule...

CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

CVE-2026-64464

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

CVE-2026-64455

CVE-2026-64455 concerns the Linux kernel USB chaoskey driver. The vulnerability is a use-after-free in chaoskey_release: after the USB device is unplugged, a debugging log statement can access the usb_interface structure that has already been deallocated, potentially leading to a crash or memory ...