CVE-2026-64401

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a use-after-free, occurs when handling witness registrations. Specifically, a second mount for the same network share can cause the system to incorrectly reference a previously freed connection, leading to...

CVE-2026-64543

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A use-after-free vulnerability exists in the tipcdiscrcv function, where the discoverer object can be prematurely freed while still being referenced. An unprivileged local user can exploit this flaw by...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: espintcp: A race condition in espintcpclose has been fixed. This issue was discovered during a code audit. After espintcpclose is called, espintcptxwork can still be scheduled using functions like the Delayed ACK handler or...

Siemens SIMATIC S7-1500 CPU 1518 MFP Race Condition within a Thread (CVE-2025-38681)

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdumpwalkpgd Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables...

SUSE CVE-2026-64491

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascamdisconnect cancels capturework and midiinwork before usbkillanchoredurbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule...

CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

CVE-2026-64455

CVE-2026-64455 concerns the Linux kernel USB chaoskey driver. The vulnerability is a use-after-free in chaoskey_release: after the USB device is unplugged, a debugging log statement can access the usb_interface structure that has already been deallocated, potentially leading to a crash or memory ...

CVE-2026-64332

The CVE-2026-64332 entry describes a Linux kernel vulnerability in the USB: ulpi driver where a memory leak occurs when registration fails. The root cause is that the allocated device name is not freed on early ULPI device registration failures. The remediation is to initialize the device structu...

PT-2026-64696

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register device failure The re-order in the Fixes commit below displaced vfio pci vga init as the last failure point of what is now vfio pci core register device without introducing an...

PT-2026-64569

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehci iso sched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until iso stream schedule and the link...

CVE-2026-64249 fpga: region: fix use-after-free in child_regions_with_firmware()

In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in childregionswithfirmware Move ofnodeputchildregion after the error print to avoid accessing freed memory when prerr references childregion. Yilun: Fix the Fixes tag...

libpng: libpng: Arbitrary code execution due to use-after-free vulnerability

A flaw was found in libpng, a library used for processing PNG Portable Network Graphics image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can...

CVE-2026-63979

A flaw was found in the Linux kernel's net/handshake component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from...

CVE-2026-63927

A flaw was found in the Linux kernel, specifically within the dwc2 USB driver. This vulnerability, known as a use-after-free, occurs when the system attempts to access memory that has already been released. This happens because a USB Request Block urb is incorrectly accessed after it has been...

libssh: libssh: use-after-free via data callbacks on closed channels

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the channel data callbacks process when data packets are processed after a channel is closed. An attacker can cause a crash or trigger unintended behavior by sending data packets to a closed channel, resulting in the...

CVE-2026-64112

A flaw was found in the Linux kernel's Rados Block Device RBD module. A race condition exists in the lockdwork draining mechanism during the unmapping of an image. This allows the lockdwork to be re-queued after it is expected to be finalized, potentially leading to rbdacquirelock executing on...

Linux Distros Unpatched Vulnerability : CVE-2026-64007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum vi...