127836 matches found
CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
CVE-2026-12366
Summary: CVE-2026-12366 in Zephyr describes a use-after-free in the dynamic object disposal path for kernels objects. When a user-thread holds the last permission on a timer (K_OBJ_TIMER) and frees it, the timer’s memory is released without cancelling its embedded _timeout node from the global _t...
EUVD-2026-58751
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
CVE-2026-12365
CVE-2026-12365 describes a kernel-use-after-free in Zephyr’s second-generation work queue (kernel/work.c) related to delayable work timeouts. If a delayable work item’s timeout has been dequeued and its handler work_timeout() is in flight, a concurrent cancellation can race, allowing a freed slot...
CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...
SUSE CVE-2026-68302
In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr or the AMT message header and then call a helper that can reallocate that head befo...
SUSE CVE-2026-73282
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...
CVE-2026-13197
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...
EUVD-2026-58673
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...
CVE-2026-13197
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...
CVE-2026-13197 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...
CVE-2022-4993
creationtimestamp| type| source ---|---|--- 2026-08-14 12:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt25flgwdt2p 2026-08-16 09:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt6vx62lze25...
JLSEC-2026-1328 In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of...
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...
Exploit for Use After Free in Linux Linux_Kernel
GhostLock SELinux park — SM-S948U1 / AZF1 m3q Research snap...
CVE-2026-64293 vulnerabilities
Vulnerabilities for packages: linux-gcp...