CWE-825
CVEs classified under CWE-825, newest first.
489 CVEsRSS
CVE-2026-98490High· 7.5⚖ disputedkernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc (CVE-2026-98490)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations lis…
CVE-2026-98491Medium· 5.9kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When cloned network packet buffers share an unconfirmed connection tracking entry, committing the entry with conflicting extensions can trigger a use-after-free memory issue du…
CVE-2026-98501Medium· 5.1⚖ disputedkernel: HID: alps: fix use-after-free on input2 registration failure (CVE-2026-98501)
A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a d…
CVE-2026-98512Medium· 5.5kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched (CVE-2026-98512)
A flaw was found in the Linux kernel's Nouveau graphics driver. When destroying a GPU scheduler object, the driver frees memory prematurely while user-space synchronization objects still hold references to it. A local, unprivileged user co…
CVE-2026-98520Medium· 4.7⚖ disputedkernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (CVE-2026-98520)
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
CVE-2026-98524High· 7.8kernel: rds: ib: Clear the sg list when mapping an MR fails (CVE-2026-98524)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A l…
CVE-2026-98548High· 7.5⚖ disputedkernel: sctp: discard the rest of the packet on a stale-cookie error (CVE-2026-98548)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted pa…
CVE-2026-98555Medium· 4.7⚖ disputedkernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (CVE-2026-98555)
A flaw was found in the Linux kernel's Logical Link Control (LLC) subsystem. When an error occurs during network packet header initialization, the kernel mistakenly frees the incorrect memory buffer, resulting in a use-after-free condition…
CVE-2026-98559Medium· 4.7kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err() (CVE-2026-98559)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free…
CVE-2026-98563Medium· 4.1kernel: net: phylink: record the PHY only once bringup cannot fail (CVE-2026-98563)
A flaw was found in the Linux kernel's phylink component. When an error occurs during Ethernet physical layer (PHY) device initialization, the kernel prematurely stores a reference to the device before setup finishes. If the bringup operat…
CVE-2026-98571Medium· 5.9kernel: net: stmmac: clear stale buf->page after recycling on skb build failure (CVE-2026-98571)
A flaw was found in the Linux kernel's stmmac network driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing incoming network traffic under resource constraints. When the driver fails to alloc…
CVE-2026-98574Medium· 4.1kernel: net: bcmgenet: stop Tx NAPI before disabling the queues (CVE-2026-98574)
A flaw was found in the Linux kernel's Broadcom GENET network driver. Improper synchronization between disabling transmission queues and stopping completion polling during interface shutdown or suspend operations can prematurely re-enable …
CVE-2026-98580Medium· 5.5kernel: nfc: llcp: Fix race condition in accept_queue lifecycle (CVE-2026-98580)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synch…
CVE-2026-98589Medium· 6.7kernel: bpf: Reject pkt arguments in mutating subprogs (CVE-2026-98589)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, fail…
CVE-2026-98592Medium· 4.7kernel: net: spacemit: clear TX descriptor on fragment mapping failure (CVE-2026-98592)
A flaw was found in the Linux kernel's SpacemiT Ethernet driver. During network packet transmission, a failure to map packet fragments causes the driver to release memory buffers without properly clearing the corresponding hardware descrip…
CVE-2026-98617Medium· 4.1kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)
A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …
CVE-2026-110753Critical· 9.8⚖ disputedText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar witho…
CVE-2026-98432Medium· 5.9⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without…
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without…
CVE-2026-86845Medium· 6.5A flaw was found in DPDK lib/vhost vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vho…
CVE-2026-98415Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block v…
In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setup_cpuhp_and_cpuidle() parses the device tree node for the interrupt generation block v…
CVE-2026-98398Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale class_cache entries for zapped classes syzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_ON(1) in hlock_class() due to an inva…
In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale class_cache entries for zapped classes syzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_ON(1) in hlock_class() due to an inva…
CVE-2026-19939Medium· 6.3The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request
The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session->timeout_wo…
CVE-2026-109765Medium· 4.2Race condition, use-after-free in the Graphics: Text component
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109741Medium· 5.4Use-after-free in the Storage: Bucket File System component
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109732Medium· 5.4⚖ disputedUse-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109729Medium· 5.4⚖ disputedUse-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109727Medium· 5.4⚖ disputedUse-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109726Medium· 5.4⚖ disputedUse-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109719Medium· 4.2⚖ disputedRace condition, use-after-free in the Graphics: CanvasWebGL component
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109717Medium· 5.4⚖ disputedUse-after-free in the DOM: Bindings (WebIDL) component
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.