22 matches found
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fixed the incorrect order of resource deallocation. When attempting to destroy a QP or CQ, we first reduce the reference count and potentially free the memory regions allocated for the object. Then, we request the devic...
netfilter Heap Buffer Overflow DoS
The vulnerability of the nfttunnelobjdestroy function in the net/netfilter/nfttunnel.c module of the netfilter component of the Linux operating system is related to the multiple release of the same resource or descriptor. Exploiting this vulnerability could allow an attacker to compromise the...
EUVD-2026-55406
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...
PT-2026-69705
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc2 Description A NULL pointer dereference occurs in the Linux kernel when detaching CCS read/write buffers. This happens because buffers are freed during Buffer Object BO destruction; if BOs are destroyed...
FreeBSD Security Advisory - FreeBSD-SA-26:37.vm
FreeBSD Security Advisory - When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's lis...
netfilter: nft_tunnel: fix use-after-free on object destroy
...
CVE-2026-53212
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfttunnel: fix use-after-free on object destroy nfttunnelobjdestroy calls metadatadstfree which directly kfrees the metadatadst, ignoring the dstentry refcount. Packets that took a reference via dsthold in...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002883)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002883 advisory. The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service host OS...
CVE-2023-53795
In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFDDESTROY should not increase the refcount syzkaller found a race where IOMMUFDDESTROY increments the refcount: obj = iommufdgetobjectucmd-ictx, cmd-id, IOMMUFDOBJANY; if ISERRobj return PTRERRobj;...
CVE-2023-53795
In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFDDESTROY should not increase the refcount syzkaller found a race where IOMMUFDDESTROY increments the refcount: obj = iommufdgetobjectucmd-ictx, cmd-id, IOMMUFDOBJANY; if ISERRobj return PTRERRobj;...
EUVD-2025-28974
Malicious code in bioql PyPI...
CVE-2024-26939 drm/i915/vma: Fix UAF on destroy against retire race
In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to be idle. 161.359441 ODEBUG: free active...
Use After Free
firefox is vulnerable to use after free. The vulnerability exists when a use-after-free could is triggered using a link with rel="localization" by destroying an object during JavaScript execution and then referencing the object through a freed pointer which causes an application crash...
php:php-fuzz-execute: Heap-use-after-free in zend_objects_store_del
Detailed Report: https://oss-fuzz.com/testcase?key=5338313876176896 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-execute Job Type: aflasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c000021980 Crash State: zendobjectsstoredel rcdtorfunc...
libucl:ucl_add_string_fuzzer: Crash in ucl_hash_destroy
Detailed Report: https://oss-fuzz.com/testcase?key=6643572678459392 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerubsanlibucl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00005049c93c Crash State: uclhashdestroy uclobjectfreeinternal...
Memory corruption
Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT...
Internet Bug Bounty: Memory Corruption in During Deserialized-object Destruction
The bug report at: https://bugs.php.net/bug.php?id=73052 The fix commit at: https://github.com/php/php-src/commit/6a7cc8ff85827fa9ac715b3a83c2d9147f33cd43...
chromium-browser: Use-after-free in ServiceWorker
Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...
Design/Logic Flaw
Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...