kernel: NFSD: Prevent client use-after-free during blocked-lock reaping

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port

A flaw was found in the Linux kernel's bridge multicast functionality. Improper management of multicast contexts when a bridge port is removed can lead to a use-after-free vulnerability. This issue could allow a local attacker to cause a system crash, resulting in a denial of service...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

kernel: nfsd: don't free session slots that are still in use

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. A remote attacker could exploit a use-after-free vulnerability in the nfsd4sequence function. This occurs when the system attempts to reduce the number of active session slots while a client is still using one of the slo...

RLSA-2026:80512 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authenticatio...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

CVE-2026-101308: Time-of-check Time-of-use (TOCTOU) Race Condition

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

FreeBSD : FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap (1fef3562-c848-11f1-ada3-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1fef3562-c848-11f1-ada3-bc241121aa0a advisory. When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not...

PT-2026-115323

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description A use after free issue in Prerender allows a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. Use after free is a memory corruption flaw that...

UBUNTU-CVE-2026-86845

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend...

CVE-2026-110138

Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Stable Channel Update for Desktop

The Stable channel has been updated to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2026:4663-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4663-1 advisory. - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. - CVE-2026-93515: X.Org Server Present Extension Use-After-Fre...

PT-2026-115316

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description A use after free issue in Compositing allows a remote attacker to execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory...

CVE-2026-109710

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Rocky Linux 8 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80973)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680973 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descriptio...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-130347)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130347 advisory. Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15,...