CVE-2026-96582

The USBX HID Report Descriptor Parser is vulnerable to a heap out-of-bounds read during ordinary enumeration. The root cause is a check-after-use flaw where the host validates that an item fits in the descriptor only after advancing past the header and parsing the payload. Because the analysis fa...

CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

CLSA-2026-1790962865 unbound: Fix of 4 CVEs

CVE-2026-82720: pop each reply off the mesh reply list before it is dropped or answered, detach the tcpreqinfo and DoH stream references and clear the h2 stream mesh states when a DoH session is dropped, so an RPZ drop or jostled query can no longer leave a dangling DoH stream reference that is...

CVE-2026-93106

A flaw was found in the Linux kernel's crashdump functionality, specifically in how it handles dm-crypt keys. When multiple dm-crypt keys are restored, a reference to the user keyring is incorrectly dropped multiple times. This can lead to a reference count underflow or a use-after-free condition...

CVE-2026-93100

A flaw was found in the Linux kernel's resctrl filesystem. A race condition exists in the rdtgroupknput function during the handling of rdtgroup structure reference counts. This allows a local attacker to trigger a use-after-free vulnerability, where memory is accessed after it has been...

CVE-2026-93104

A flaw was found in the Linux kernel RDMA/rvt component. The rvtallocdevice function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issu...

CVE-2026-93099

A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free UAF vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leadin...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-93091

A flaw was found in the armscmi firmware component of the Linux kernel. A race condition exists during the teardown of notifications or on the probe error path. This can allow an attacker to trigger a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...

CVE-2026-93075

A flaw was found in the Linux kernel's dax/fsdev component. When a static device is unbound, the pgmap operations and owner are not properly cleared. This can lead to a use-after-free vulnerability where a subsequent memory failure event might dispatch through a stale or freed handler, potentiall...

CVE-2026-93069

A flaw was found in the Linux kernel's Optimized Power Management OPP subsystem. An incorrect cleanup ordering during the initialization of internal pointers can lead to a use-after-free error. This occurs when the system attempts to release a reference to an already freed memory region. Such an...

CVE-2026-93066

A flaw was found in the Linux kernel. A race condition in the x86/mm/pat component, specifically between cpacollapselargepages and changepageattr, can lead to a use-after-free vulnerability. A local attacker, by concurrently loading and unloading modules, could exploit this to write into freed...

CVE-2026-93060

A flaw was found in the Linux kernel's Adreno GPU driver. This use-after-free vulnerability occurs in the a6xxgpuinit function. Specifically, the a6xxdestroy function frees the a6xxgpu memory, but adrenogpu continues to point to the freed memory. An attacker could potentially exploit this to caus...

CVE-2026-98490

A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially...

CVE-2026-93050

A flaw was found in the Linux kernel's ipack: ipoctal module. This vulnerability arises from improper memory handling, specifically Use-After-Free UAF conditions and a NULL pointer dereference, when the device is removed while a terminal tty session is still active. A local attacker could exploit...

CVE-2026-98487

A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database MDB port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting in a use-after-free condition. A local attacker could exploi...

xorg-x11-server-Xwayland security update

An update is available for xorg-x11-server-Xwayland. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Xwayland is an X server for running X clients under Wayland...