CVE-2019-13272

CVE-2019-13272 Linux ローカル root エクスプロイト Linux 4.10 5.1.17 PTRACETRACEME ローカル root CVE-2019-13272 root@kitploit: In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: rt2x00usb – Fix for the device lifetime issue. USB drivers bind to USB interfaces, and any device’s managed resources should have their lifetime tied to the interface, rather than the parent USB device. This prevents issues...

CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

EUVD-2026-76481

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89570

A lifetime bug in the Linux kernel's CXL (Compute Express Link) MCE notifier can cause NULL dereferences and use-after-free in the MCE handler. The notifier was incorrectly registered per memory device (stored in struct cxl_memdev_state) rather than per region. The fix moves it into struct cxl_re...

CVE-2026-89570 cxl/mce: Make the MCE notifier per-region

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89570 cxl/mce: Make the MCE notifier per-region

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104616)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104616 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fixed the lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned by amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is n...

SUSE CVE-2026-68245

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

CVE-2026-72282

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-72282

The CVE-2026-72282 entry concerns the Linux kernel KVM path: kvm_io_bus_get_dev() now requires the caller to hold the srcu lock, moving locking responsibilities to the caller. The function returns a device matched only by address, which can lead to a lifetime issue if the device’s type isn’t as e...

CVE-2026-72282: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...

CVE-2026-68245

CVE-2026-68245 affects the Linux kernel’s DRM/amdgpu component. The issue is a use-after-unlock: a vm pointer retrieved via amdgpu_vm_get_vm_from_pasid() is used after xa_unlock_irqrestore releases the lock, leaving the pointer vulnerable to modification. The documented fix removes the dependency...

CVE-2026-68245 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

RUSTSEC-2026-0198 `Report::frames_mut` allows aliased mutable references

Affected versions of this crate return an iterator from Report::framesmut whose &mut Frame items have lifetimes independent of the iterator, so all yielded references can be held at the same time. A yielded frame's sources are also yielded by the iterator and reachable through the parent frame vi...

can: ucan: fix devres lifetime

...

ROS-20260414-73-0023

Vulnerability in kernel-lt related to lack of memory release after effective lifetime. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-3236

In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token...