CWE-364
CVEs classified under CWE-364, newest first.
18 CVEsRSS
CVE-2026-92067High· 8.8⚖ disputedUse-after-free in the Widget: Gtk component
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-80991Medium· 5.5⚖ disputedkernel: net: ravb: serialize PTP clock teardown (CVE-2026-80991)
A flaw was found in the Linux kernel's `net: ravb` module. A race condition exists during the Precision Time Protocol (PTP) clock teardown. This allows the `ravb_ptp_interrupt()` function to attempt to use a PTP clock after it has been fre…
CVE-2026-89472Medium· 5.5⚖ disputedkernel: power: supply: charger-manager: register regulators before exposing sysfs (CVE-2026-89472)
A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this b…
CVE-2026-89654High· 7.0⚖ disputedkernel: ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654)
A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the `check_new_map()` function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a …
CVE-2026-80932Medium· 5.5⚖ disputedkernel: vsock/virtio: flush works in dependency order (CVE-2026-80932)
A flaw was found in the Linux kernel, specifically within the `vsock/virtio` component. An incorrect order of flushing work items during the removal of a `virtio_vsock` object can lead to a use-after-free condition. This vulnerability allo…
CVE-2026-89463Medium· 5.5kernel: power: supply: ucs1002: fix use-after-free on remove (CVE-2026-89463)
A flaw was found in the Linux kernel's `ucs1002` power supply driver. The driver does not properly cancel a delayed work item during device removal, leading to a use-after-free vulnerability. This issue allows the system to attempt to acce…
CVE-2026-89625High· 7.0In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer: ghl_magic_poke() (the timer cal…
In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer: ghl_magic_poke() (the timer cal…
CVE-2026-89468Medium· 5.5kernel: power: supply: lp8788-charger: fix use-after-free on remove (CVE-2026-89468)
A flaw was found in the Linux kernel's lp8788-charger component. During the removal of the lp8788-charger, a race condition can occur where work can be queued and executed after the associated memory has been freed. This use-after-free vul…
CVE-2026-64560High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sy…
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sy…
CVE-2026-53239High· 7.8In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Us…
CVE-2026-53185High· 7.8In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_…
CVE-2026-53192High· 7.8In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called…
CVE-2026-52977Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup During wait-requeue-pi (task A) and requeue-PI (task B) the following race can happen: Task A …
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup During wait-requeue-pi (task A) and requeue-PI (task B) the following race can happen: Task A …
CVE-2026-52910High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog a…
CVE-2026-46090High· 7.8In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match…
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match…
CVE-2025-4598Medium· 4.7A vulnerability was found in systemd-coredump
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensit…
CVE-2024-6409High· 7.0A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd)
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this…
CVE-2024-6387High· 8.1PoCA security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by f…