CWE-825
CVEs classified under CWE-825, newest first.
489 CVEsRSS
CVE-2026-53918High· 8.8odhcpd DHCPv6 IA dangling first pointer use-after-free
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure …
CVE-2026-98870Medium· 6.5⚖ disputedkernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…
CVE-2026-98739Medium· 4.4kernel: Bluetooth: RFCOMM: Fix initial port reference race (CVE-2026-98739)
A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A local user could exploit this flaw to cause a Denial of Service (DoS) or potentially escalate privileges. A race condition between concurrent device installation and rele…
CVE-2026-98736Medium· 4.7kernel: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (CVE-2026-98736)
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented (SCO) link setup due to missing locking when accessing parent connection structures. A local user or adjace…
CVE-2026-98735Medium· 4.7kernel: Bluetooth: hci_core: Serialize ACL scheduling with channel deletion (CVE-2026-98735)
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local…
CVE-2026-98740Medium· 4.1kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)
A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…
CVE-2026-98754High· 7.0tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callback…
CVE-2026-98757Medium· 4.1kernel: usb: cdns3: fix use-after-free in cdns3_gadget_exit() (CVE-2026-98757)
A flaw was found in the Linux kernel's Cadence USB3 gadget driver. This vulnerability can lead to a Denial of Service (DoS) through a system crash or potentially allow privilege escalation. During device teardown, the driver releases memor…
CVE-2026-98758Medium· 4.1kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)
A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …
CVE-2026-98766Medium· 4.1kernel: usb: gadget: aspeed-vhub: cancel wake work on device removal (CVE-2026-98766)
A flaw was found in the Linux kernel's Aspeed virtual hub (vhub) driver. When a device is removed, scheduled wakeup tasks are not properly canceled, allowing background work to run after the associated memory structures have been freed. A …
CVE-2026-98763Medium· 6.2kernel: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (CVE-2026-98763)
A flaw was found in the Linux kernel's USB subsystem. This vulnerability allows an attacker with physical access connecting a malicious USB device, or a local user with privileges to emulate USB hardware, to cause a Denial of Service (DoS)…
CVE-2026-98772Medium· 4.7kernel: USB: serial: fix port tear down use-after-free (CVE-2026-98772)
A flaw was found in the Linux kernel's USB serial subsystem. This flaw may result in a Denial of Service (DoS) due to a use-after-free vulnerability. During multiport device disconnection, a race condition allows background completion hand…
CVE-2026-98775Medium· 5.5kernel: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure (CVE-2026-98775)
A flaw was found in the Linux kernel's Nitro Enclaves driver. An error-handling defect during enclave creation allows memory to be accessed after it has already been freed. A local attacker could exploit this use-after-free condition to ca…
CVE-2026-98773Medium· 4.7kernel: USB: cdc-acm: skip URB restart in port_shutdown if disconnected (CVE-2026-98773)
A flaw was found in the Linux kernel's CDC ACM (Communications Device Class Abstract Control Model) USB driver. A timing race condition during device disconnection and port closure can lead to a use-after-free vulnerability when communicat…
CVE-2026-98799Medium· 4.4kernel: bpf: Skip detached progs in trampoline images that are still in use (CVE-2026-98799)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached while another task is paused in an active routine, the kernel can prematurely release the detached progr…
CVE-2026-98804Medium· 4.7kernel: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() (CVE-2026-98804)
A flaw was found in the Linux kernel's networking subsystem. When page pool statistics are enabled, a race condition in the bulk recycling mechanism can allow a memory pool to be freed before statistical updates finish processing. An attac…
CVE-2026-98814Medium· 4.4kernel: nvme: fix command effects log lifetime for multipath heads (CVE-2026-98814)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. A local attacker can cause a denial of service (DoS) or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/…
CVE-2026-98813Medium· 4.4kernel: bpf: Hold map BTF for the memory allocator destructor record (CVE-2026-98813)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing…
CVE-2026-98815Medium· 4.1nvme: fix cdev lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in [0] - the code there is heavily based on the NVMe code. Currently the NS hea…
CVE-2026-98837Medium· 5.5kernel: ALSA: caiaq: unregister the input device when probe fails (CVE-2026-98837)
A flaw was found in the Linux kernel's ALSA caiaq USB audio driver. This flaw allows a local attacker to cause a Denial of Service (DoS) or potentially escalate privileges. When device initialization fails during the probing process, the d…
CVE-2026-98846Medium· 5.5kernel: sctp: check RCV_SHUTDOWN after the sendmsg connect wait (CVE-2026-98846)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. A race condition can occur when an SCTP socket is shut down concurrently while waiting for a connection, causing an association structure to be f…
CVE-2026-98858Medium· 5.5kernel: io_uring: fix task_work add use-after-free with SQPOLL (CVE-2026-98858)
A flaw was found in the Linux kernel's io_uring subsystem. When submission queue polling (SQPOLL) is enabled, a race condition can cause the polling thread to free the ring context while another operation is still accessing it. A local use…
CVE-2026-98866Medium· 4.7kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF (CVE-2026-98866)
A flaw was found in the Linux kernel. A use-after-free vulnerability, where memory is accessed after being released, occurs in the process scheduler cache component during task memory switches. A local user could exploit this flaw to cause…
CVE-2026-98863Medium· 5.6kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (CVE-2026-98863)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. When running nested virtual machines, the hypervisor fails to properly re-queue a memory page request if retrieving state pages for a nested guest fails d…
CVE-2026-98862Medium· 4.1kernel: audit: fix exe mark UAF in kill_rules() (CVE-2026-98862)
A flaw was found in the Linux kernel's audit subsystem. A race condition can occur when an audit directory tree is removed while another process evaluates executable audit rules, causing the kernel to access memory after it has been releas…
CVE-2026-98441Medium· 4.7⚖ disputedkernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (CVE-2026-98441)
A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. Th…
CVE-2026-98442High· 7.5kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)
A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption throu…
CVE-2026-98443Medium· 4.4⚖ disputedkernel: xfs: fix cursor and pointer handling when recovering iunlink buckets (CVE-2026-98443)
A flaw was found in the Linux kernel's XFS file system. Improper pointer handling during the recovery of unlinked files can cause a use-after-free condition, where the operating system attempts to access memory after it has already been fr…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98483Medium· 5.5kernel: nfc: fix use-after-free in nfc_get_local_general_bytes (CVE-2026-98483)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. A reference counting error in the nfc_get_local_general_bytes() function causes memory to be freed prematurely while callers still access the returned pointer…