Exploit for Use After Free in Google Android

mi5-temp-root Temporary root for Xiaomi Mi 5 gemini / MIU...

CLSA-2026-1792487559 Fix CVE(s): CVE-2026-15176, CVE-2026-56434

SECURITY UPDATE: heap buffer overflow when mapping a rewritten URI to a path in a location using alias - debian/patches/CVE-2026-15176.patch: reject URI to path mapping in ngxhttpmapuritopath when r-urichanged is set, so a rewrite that shortens the URI below the alias location prefix can no longe...

Security update for unbound

This update for unbound fixes the following issues: CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission bsc1280405...

SUSE-SU-2026:24376-1 Security update for unbound

This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission...

K000163787: curl vulnerability CVE-2026-92392

Security Advisory Description During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Impact There is no impact; F5 products are not affected by this...

CVE-2026-98749

A flaw was found in the MAX3100 serial driver in the Linux kernel. This flaw allows a local privileged user to cause a Denial of Service DoS or memory corruption by unbinding the device during a system suspend cycle. In this scenario, the driver releases the device port memory while an active...

CVE-2026-98662

A flaw was found in the Linux kernel's gp2ap020a00f ambient light sensor driver. During device removal or initialization failure, the driver fails to properly drain scheduled interrupt tasks before releasing memory structures. A local user capable of unbinding or disconnecting the device can...

CVE-2026-98748

A flaw was found in the Linux kernel's Broadcom serial driver. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. During device removal, an incoming interrupt can restart a timer after it has been cancelled, leading to a use-after-free...

CVE-2026-98826

A flaw was found in the Linux kernel's AC100 Real-Time Clock RTC driver. If device initialization fails during driver probing, unmanaged clock provider references remain registered in global system lists while their underlying memory is released. Subsequent lookups referencing the affected device...

CVE-2026-93117

A flaw was found in the Linux kernel's USB subsystem. This use-after-free UAF vulnerability occurs when a dynamic ID is removed concurrently while the usbprobeinterface function is still using it. A local attacker could potentially exploit this timing issue, leading to memory corruption and...

CVE-2026-90427

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. During the tegra241cmdqvprobe function, a memory reallocation operation can free an existing memory region. If this reallocation fails, a subsequent fallback path attempts to access the previously freed memory. This...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: sctp: stop processing a packet once its association is deleted

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the kernel attempts to access memory that has already been...

kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

A flaw was found in the Linux kernel's netfilter subsystem. When a network namespace is dismantled, the packet logging component frees memory without waiting for ongoing logging operations to complete, resulting in a use-after-free condition. A local attacker could exploit this flaw during networ...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

kernel: sctp: keep chunk->transport in step with the list it is queued on

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This use-after-free vulnerability occurs when the system improperly handles chunk transport pointers during the retransmission process. A remote attacker can exploit this by sending specially crafted...

kernel: netfilter: flowtable: hold reference on ct until flow is released

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a...

CVE-2026-98580

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synchronization. A local attacker could exploit this flaw to cause ...

kernel: netfilter: flowtable: hold reference on ct until flow is released

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a...

kernel: sctp: keep chunk->transport in step with the list it is queued on

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This use-after-free vulnerability occurs when the system improperly handles chunk transport pointers during the retransmission process. A remote attacker can exploit this by sending specially crafted...