Windows-WinSock-UAF-Mitigation

CVE-2026-68820: Windows WinSock afd.sys UAF Mitigation This repository contains a conceptual patch demonstrating the mitigation for CVE-2026-68820 , a critical Use-After-Free UAF vulnerability in the Windows Ancillary Function Driver for WinSock afd.sys. Active exploitation of this flaw allows a...

CVE-2026-123866

A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RSTSTREAM or by the server's own per-stream timeout...

CVE-2025-60458

CVE-2025-60458 UxPlay 1.72 RTSP TEARDOWN Double Free Vulnerability Description UxPlay version 1.72 contains a double free vulnerability in its RTSP request handling logic. A remote attacker can trigger multiple calls to free on the same heap memory object by sending a specially crafted RTSP...

kernel: sctp: avoid auth_enable sysctl UAF during netns teardown

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This Use-After-Free UAF vulnerability occurs during network namespace netns teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a...

CVE-2026-123863

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream...

Linux Distros Unpatched Vulnerability : CVE-2026-123866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a...

nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown

A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service DoS by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can...

kernel: sctp: avoid auth_enable sysctl UAF during netns teardown

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This Use-After-Free UAF vulnerability occurs during network namespace netns teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a...

nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown

A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service DoS by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can...

CVE-2026-123866

A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RSTSTREAM or by the server's own per-stream timeout...

CVE-2026-123866 Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown

A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RSTSTREAM or by the server's own per-stream timeout...

CVE-2026-123866

Node.js is vulnerable to a use-after-free vulnerability in the HTTP/2 stream teardown process. When a stream is torn down while a write is still backpressured (e.g., by a peer RST_STREAM or a per-stream timeout), the response buffer is freed but a reference to it remains active. This allows freed...

kernel: openvswitch: Fix CT limit teardown use-after-free

A flaw was found in the Linux kernel's Open vSwitch OVS component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking CT limit...

kernel: nvmet-auth: Synchronize timeout work during SQ teardown

A flaw was found in the nvmet-auth component of the Linux kernel. A timing issue during the cleanup of a Submission Queue SQ can lead to a use-after-free vulnerability. This occurs when a delayed authentication task attempts to access memory that has already been released or repurposed. An attack...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151120 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151169 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running...

CVE-2026-99276

A flaw was found in the Linux kernel's ksmbd Server Message Block server. A remote client can cause a Denial of Service DoS by triggering a deadlock condition during concurrent session teardown and connection cleanup operations. Because the periodic connection cleanup worker and session terminati...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installs sb-sroot before it loads the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Cancel SSR work items during PCI shutdown A reboot may cause the kernel to crash if it overlaps with the WLAN firmware’s recovery process SSR. The crash occurs due to a NULL pointer dereference in the MHI teardown...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect iterates through usbio-clilist in reverse order and uninitializes each auxiliary device. auxiliarydeviceuninit releases the device reference; for an unbound...