PT-2026-20452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel’s ksmbd module contains a synchronization issue within the ksmbd chann list xarray. This lack of synchronization can lead to a use-after-free condition in multi-channel...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992754)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992754 advisory. In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroyworkqueue call There is a possible race condition use-after-free...

EUVD-2022-55860

In the Linux kernel, the following vulnerability has been resolved: net: stream: purge skerrorqueue in skstreamkillqueues Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1 SOFTIMESTAMPINGTXACK is enabled on the socket. Each ACK...

CVE-2023-54271

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkgpolicydata being installed before init blk-iocost sometimes causes the following crash: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... RIP: 0010:rawspinlock+0x17/0x30...

CVE-2023-54226

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix data races around sk-skshutdown. KCSAN found a data race around sk-skshutdown where unixreleasesock and unixshutdown update it under unixstatelock, OTOH unixpoll and unixdgrampoll read it locklessly. We need to annota...

CVE-2022-50838 net: stream: purge sk_error_queue in sk_stream_kill_queues()

In the Linux kernel, the following vulnerability has been resolved: net: stream: purge skerrorqueue in skstreamkillqueues Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1 SOFTIMESTAMPINGTXACK is enabled on the socket. Each ACK...

SUSE CVE-2022-50726

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5cmdcleanupasyncctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5cmdcleanupasyncctx and...

SUSE CVE-2023-54067

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when deleting free space root from the dirty cow roots list When deleting the free space tree we are deleting the free space root from the list fsinfo-dirtycowonlyroots without taking the lock that protects it,...

The vulnerability of the web page rendering module in WebKit operating systems for macOS, iOS, and iPadOS allows a hacker to trigger a service failure.

The vulnerability of the web page rendering module in WebKit operating systems for macOS, iOS, and iPadOS is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service interruptions...

The vulnerability of the Checkpointing module in the NVIDIA Resiliency Extension (NVRx) toolset, which is designed to enhance the fault tolerance of large-scale distributed training systems. This vulnerability allows attackers to gain unauthorized access to protected information, replace data, enhance their privileges, or trigger service failures.

The vulnerability of the Checkpointing module in the NVIDIA Resiliency Extension NVRx toolset, which is designed to improve the fault tolerance of large-scale distributed training systems, is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow...

CVE-2023-54120

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidpsessionthread There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the timer is active while hidpdeltimer is called in hidpsessionthread. Aft...

CVE-2022-50726

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5cmdcleanupasyncctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5cmdcleanupasyncctx and...

CVE-2023-54120 Bluetooth: Fix race condition in hidp_session_thread

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidpsessionthread There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the timer is active while hidpdeltimer is called in hidpsessionthread. Aft...

CVE-2023-54067

In CVE-2023-54067, the Linux kernel btrfs subsystem fixes a race when deleting the free space root from fs_info->dirty_cowonly_roots by not holding the trans_lock. The unsynchronized list manipulation could race with concurrent modifications (e.g., adding a root via ctree.c:add_root_to_dirty_l...

CVE-2022-50726

CVE-2022-50726: In the Linux kernel mlx5 driver, a use-after-free could occur due to a race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler when inflight commands reach zero. The issue was fixed by using a completion object and marking it completed when num_inflight reaches 0, ens...

CVE-2022-50726 net/mlx5: Fix possible use-after-free in async command interface

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5cmdcleanupasyncctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5cmdcleanupasyncctx and...

CVE-2022-50726 net/mlx5: Fix possible use-after-free in async command interface

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5cmdcleanupasyncctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5cmdcleanupasyncctx and...

CVE-2023-53998

CVE-2023-53998: Linux kernel virtio RNG (hwrng) data_race between writer and reader in data_avail; fix uses smp_store_release on data_avail and smp_load_acquire on first read, with safe subsequent reads. Also removes redundant zeroing of data_idx in random_recv_done and data_avail in request_entr...

CVE-2022-50697

CVE-2022-50697 affects the Linux kernel via the MRP timer path: a use-after-free risk in hlist/timer handling can occur if del_timer_sync is not synchronized to prevent timer restart. Connected advisories (EulerOS Unity/Linux OSS plugins) cite this flaw and describe a fix that adds active flags t...

CVE-2022-50697 mrp: introduce active flags to prevent UAF when applicant uninit

In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of deltimersync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be...