CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64370

CVE-2026-64370 is a Linux kernel vulnerability in the posix-cpu-timers subsystem. In do_cpu_nanosleep(), the call to posix_cpu_timer_create() acquires a pid reference via get_pid() and stores it in timer.it.cpu.pid. When the subsequent posix_cpu_timer_set() call fails, the function returns withou...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

EUVD-2026-48914

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64365

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

CVE-2026-64365 HID: letsketch: fix UAF on inrange_timer at driver unbind

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

EUVD-2026-48909

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

CVE-2026-64365 HID: letsketch: fix UAF on inrange_timer at driver unbind

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

CVE-2026-64365

A use-after-free (UAF) vulnerability in the Linux kernel's HID letsketch driver occurs because the driver lacks a .remove callback to drain its inrange_timer on device unbind. If the timer was armed within ~100 ms of unbind, it fires on freed memory, dereferencing data and data->input_tablet a...

CVE-2026-64363 HID: appleir: fix UAF on pending key_up_timer in remove()

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

EUVD-2026-48907

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

CVE-2026-64363

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

CVE-2026-64363

CVE-2026-64363 is a use-after-free in the Linux kernel's HID appleir driver (Apple IR remote). The appleir_remove() path calls hid_hw_stop() before draining the key_up_timer, allowing the timer callback to dereference an already-freed input_dev. A USB URB completion racing during teardown can add...

CVE-2026-64363 HID: appleir: fix UAF on pending key_up_timer in remove()

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...

PT-2026-64586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the HID letsketch driver. The letsketch probe function initializes a per-device timer inrange timer using timer setup, which is subsequently re-armed...

PT-2026-64591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A pid refcount leak occurs in the do cpu nanosleep function. The posix cpu timer create function acquires a pid reference using get pid and stores it in timer.it.cpu.pid. If the followin...

Linux Distros Unpatched Vulnerability : CVE-2026-64363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input...

PT-2026-64584

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the appleir driver. The appleir remove function executes hid hw stop before timer delete sync, which can lead to the input dev being freed while a...

GHSA-G5VV-Q72C-7J78 @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...