EUVD-2025-208186

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls...

The vulnerability of the migrate_device_finalize() function in the mm/migrate_device.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a service failure.

The vulnerability of the migratedevicefinalize function in the mm/migratedevice.c file of the Linux kernel’s memory management subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-22642

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A memory corruption issue exists when processing IOCTL calls. This occurs due to accessing a buffer after it has been freed. The issue involves a memory corruption vulnerability that could potentiall...

SUSE CVE-2026-25955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...

The vulnerability of the tsi148_dma_list_add() function in the drivers/staging/vme_user/vme_tsi148.c module allows a hacker to trigger a service failure.

The vulnerability of the tsi148dmalistadd function in the drivers/staging/vmeuser/vmetsi148.c module, which supports additional devices in the Linux operating system’s kernel, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to caus...

The vulnerability of the stmmac_request_irq_multi_msi() function in the drivers/net/ethernet/stmicro/stmmac/stmmac_main.c file of the Ethernet network adapter driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the stmmacrequestirqmultimsi function in the drivers/net/ethernet/stmicro/stmmac/stmmacmain.c file of the Ethernet network adapter driver for the Linux operating system from STMicroelectronics is related to the reutilization of previously freed memory. Exploiting this...

CVE-2026-26986

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferences a freed xfAppWindow pointer during HashTableFree cleanup because xfrailwindowcommon calls freeappWindow on title allocation failure without first removing the entry from the...

CVE-2026-25953

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xfrailgetwindow without any lifetime protection, while the main thread can concurrently...

CVE-2026-25955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...

CVE-2026-25955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...

CVE-2026-25955

CVE-2026-25955 is a vulnerability in FreeRDP (prior to 3.23.0) where the function xf_AppUpdateWindowFromSurface reuses a cached XImage that points to freed memory in an RDPGFX surface buffer. The root cause is that gdi_DeleteSurface frees surface->data without invalidating the aliasing appWind...

CVE-2026-25952

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfSetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xfrailgetwindow in xfrailserverminmaxinfo returns an unprotected pointer from the railWindows hash table, and the main thread can...

GHSA-WFX3-6G53-9FGC ImageMagick: Memory Leak in multiple coders that write raw pixel data

A memory leak vulnerability exists in multiple coders that write raw pixel data where an object is not freed. Direct leak of 160 bytes in 1 objects allocated from:...

Use After Free

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

kernel: ext4: fix use-after-free in ext4_orphan_cleanup

A use-after-free vulnerability was found in the ext4 filesystem's orphan inode cleanup routine in the Linux kernel. When ext4inodeattachjinode fails with -ENOMEM during orphan cleanup at mount time, the error is not properly propagated. The inode is freed via iput, but the orphan list still...

The vulnerability of the igb_alloc_q_vector() function in the drivers/net/ethernet/intel/igb/igb_main.c file of the Intel Ethernet network adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the igballocqvector function in the drivers/net/ethernet/intel/igb/igbmain.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the btsdioremove() function in the drivers/bluetooth/btsdio.c file of the Linux kernel’s Bluetooth device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the btsdioremove function in the drivers/bluetooth/btsdio.c file of the Linux kernel’s Bluetooth device driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the handle_tx_event() function in the drivers/usb/host/xhci-ring.c file of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the handletxevent function in the drivers/usb/host/xhci-ring.c file of the Linux USB device driver framework is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the `ksmbd_session_rpc_open()` function in the `fs/smb/server/mgmt/user_session.c` module of the SMB server support in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ksmbdsessionrpcopen function in the fs/smb/server/mgmt/usersession.c module, which is part of the SMB server support in Linux operating systems, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise th...

The vulnerability of the nfsd4_close_open_stateid() function in the fs/nfsd/nfs4state.c module, which is part of the Linux kernel’s Network File System support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nfsd4closeopenstateid function in the fs/nfsd/nfs4state.c module, which is part of the Linux kernel’s Network File System support, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...