CWE-1341
CVEs classified under CWE-1341, newest first.
41 CVEsRSS
CVE-2026-112402High· 7.5PoCPillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-98823Medium· 5.3kernel: wifi: cfg80211: preserve hidden-group beacon IE ownership (CVE-2026-98823)
A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This issue allows an adjacent attacker within wireless range to cause a Denial of Service (DoS) by crashing the system. During a channel switch, the kernel improperly mana…
CVE-2026-98834Medium· 4.1kernel: mtd: core: avoid double-free of OTP NVMEM device (CVE-2026-98834)
A flaw was found in the Linux kernel's Memory Technology Device (MTD) subsystem. An attacker capable of triggering device registration failures can cause a Denial of Service (DoS) via a kernel crash. During the setup of One-Time Programmab…
CVE-2026-98855Medium· 4.4kernel: of/overlay: put property on deadprops only after changeset add succeeds (CVE-2026-98855)
A flaw was found in the Linux kernel's Device Tree overlay subsystem. When an error occurs while adding a property to a device tree overlay changeset, the allocated property is freed during error cleanup but remains tracked, leading to a s…
CVE-2026-98515Medium· 4.7⚖ disputedkernel: drm/nouveau: fix double-free in nvif_vmm_dtor (CVE-2026-98515)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges. During device initialization failures,…
CVE-2026-94370High· 8.1A defect in the Qt for MCUs core string handling causes heap memory corruption
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion t…
CVE-2026-107886Low· 2.3PoCOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validat…
CVE-2026-47558High· 7.8NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution,…
CVE-2026-97532High· 7.0In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00…
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00…
CVE-2026-97585Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afs_edit_dir_remove() to use a cleanup function to unmap the block pointed to by afs_dir_iter::block if it's left pointing…
In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afs_edit_dir_remove() to use a cleanup function to unmap the block pointed to by afs_dir_iter::block if it's left pointing…
CVE-2026-98066High· 7.0In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common des…
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common des…
CVE-2026-98154High· 7.0In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. Th…
CVE-2026-93827High· 8.4In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs()
In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails,…
CVE-2026-97424Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(),…
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(),…
CVE-2026-90268High· 8.1In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister…
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister…
CVE-2026-92489Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferre…
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferre…
CVE-2026-92506Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix requested device removal race scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but continues to reta…
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix requested device removal race scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but continues to reta…
CVE-2026-89767High· 7.8⚖ disputedovl: fix double end_creating() on the casefold-mismatch path
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases the new dentry twice when the casefold consistency check fails. The S_IFDIR br…
CVE-2026-80989High· 8.8net: thunderbolt: Mark the connection down when bringing it up fails
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnet_connected_work() undoes its own work and returns without clearing logi…
CVE-2026-89582High· 7.0bnx2x: fix double free in bnx2x_init_firmware() error path
In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without s…
CVE-2026-89563High· 7.8ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently …
CVE-2026-89741Medium· 4.7kernel: Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the `__video_register_device()` function. If a device registration fails, the sy…
CVE-2026-89161High· 7.4In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
CVE-2026-80775High· 7.0PoCkernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
A flaw was found in the Linux kernel. A race condition exists in the `futex_hash_allocate()` function, specifically during the initial allocation of `mm->futex.phash.ref`. This vulnerability can be triggered in scenarios involving nested `…
CVE-2026-63652Medium· 6.5FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing t…
CVE-2026-64570High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement.…
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement.…
CVE-2026-66373High· 7.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…
CVE-2026-64387Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init…
CVE-2026-64386Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails…
CVE-2026-64385Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails b…