186104 matches found
SUSE CVE-2026-98800
In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...
CVE-2026-98544
A flaw was found in the Linux kernel's Brocade 10Gb Ethernet bna driver. During device removal or shutdown, internal timers can rearm each other and continue executing after associated driver data structures have been released. A local user with administrative privileges could exploit this race...
PYSEC-2026-4328
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...
DEBIAN-CVE-2026-112396
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...
CVE-2026-112396
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...
PYSEC-2026-4328
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...
CVE-2026-112258
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...
CVE-2026-112261
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution...
DEBIAN-CVE-2026-112261
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution...
DEBIAN-CVE-2026-112258
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...
kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...
kernel: exec: Cleanup POSIX timers right after de_thread()
A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
kernel: signal: Prevent exec() race
A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege...
kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication protocol. A local attacker could exploit this vulnerability by repeatedly creating and failing to insert new sockets, causing the tipcskcreate function to leave a dangling pointer to a freed socket object. This...
kernel: Bluetooth: hci_sync: Fix advertising data UAFs
A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hcisync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free UAF vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly durin...
kernel: sctp: keep chunk->transport in step with the list it is queued on
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This use-after-free vulnerability occurs when the system improperly handles chunk transport pointers during the retransmission process. A remote attacker can exploit this by sending specially crafted...
kernel: sctp: avoid auth_enable sysctl UAF during netns teardown
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This Use-After-Free UAF vulnerability occurs during network namespace netns teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a...
CVE-2026-112396
A flaw was found in Pillow. This vulnerability allows a remote attacker to potentially execute arbitrary code or cause a Denial of Service DoS. The issue occurs when an application encodes Tagged Image File Format TIFF data with untrusted tags into an in-memory buffer. When an invalid tag is...
CVE-2026-110686
A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is stil...