CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

CVE-2026-80692

CVE-2026-80692 affects the Linux kernel Bluetooth subsystem, specifically the hci_sync component used in hci_connect_acl and hci_connect_le_sync callbacks. The root cause is a theoretical Use-After-Free (UAF) that occurs if the Bluetooth connection object (conn) is freed while the hci_sync workqu...

CVE-2026-80642

CVE-2026-80642 affects the Linux kernel 's liveupdate subsystem. During a Live Update, a subsystem may need to hold incoming File-Lifecycle-Bound (FLB) data for an extended period (e.g., during device enumeration). The vulnerability stems from a missing reference count on the incoming FLB structu...

CVE-2026-80619

CVE-2026-80619 is a potential Use-After-Free (UAF) in the Linux kernel's AppArmor subsystem. The function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), which releases the underlying data structure, leaving a dangling pointer. The fix saves the size value to a l...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC PinTheft CVE-2026-43494 Prova di concetto — uid=1000raken → uid=0root dopo ./sley su WSL2 6.6.87.2-microsoft-standard-WSL2 Prova di concetto in un singolo file per CVE-2026-43494 PinTheft: un'escalation dei privilegi locale del kernel Linux che combina un bug di conteggio dei riferimen...

CVE-2023-20938

CVE-2023-20938 English Analisi della vulnerabilità 1. Il client A e il client B stabiliscono una connessione Binder tramite il context manager servicemanager 2. A crea il node 0xbeef node = bindernewnodeproc, fp;, B fa riferimento al node 0xbeef tramite ref-targetnode 3. B prima gestisce...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 Lokale Privilegieneskalation im Linux-Kernel durch RDS + iouring Page Cache Overwrite 📌 Übersicht PinTheft ist ein ausgeklügelter lokaler Root-Exploit für CVE-2026-43494 , einen Referenzzählungsfehler im Reliable Datagram Sockets RDS-Subsystem des Linux-Kernels. Durch...

CVE-2026-80519 ovpn: finish crypto callback cleanup before peer release

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fixed potential use after free in efcnportvportdel The krefput function will call nport-release if the reference count drops to zero. The nport-release function is efcnportfree, which frees the “nport” object...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...

CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

CVE-2026-74264

A flaw was found in the Linux kernel's network watchdog component. A race condition in the reference count tracking mechanism, specifically between netdevwatchdogup and devwatchdog, allows for concurrent overwriting or freeing of reference tracking information. This can lead to list corruption an...

CVE-2026-72469

A flaw was found in the xprtrdma component of the Linux kernel. An attacker could potentially exploit a use-after-free vulnerability due to an improper handling of Remote Direct Memory Access RDMA connection events. Specifically, an address change event occurring before a connection is fully...

Linux Distros Unpatched Vulnerability : CVE-2026-74381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so i...

The vulnerability in the `fs/smb/server/transport_tcp.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the fs/smb/server/transporttcp.c component of the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-74540

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2capleconnectrsp l2capleconnectrsp obtains a channel via l2capgetchanbyident but neither holds a reference nor uses l2capchanholdunlesszero before locking and operating on it. A concurrent l2capchand...

EUVD-2026-59722

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between devpmoppadddynamic and devpmoppfindfreqexact: CPU0 add CPU1 lookup ------------------------------- ------------------------------ oppadd mutexlock...

CVE-2026-74393

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drmsyncobjfindfence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drmsyncobjfindfence" forgot to take into account the fact that drmsyncobjfind takes a reference to syncobj and returns...