CWE-825
CVEs classified under CWE-825, newest first.
181 CVEsRSS
CVE-2026-80981High· 7.0⚖ disputedkernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)
A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the `smc_llc_srv_add_link()` function, where a freed memory region is improperly accessed. This can lead to memory c…
CVE-2026-80955Medium· 5.5⚖ disputedkernel: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() (CVE-2026-80955)
A flaw was found in the Linux kernel's dm-pcache component. This vulnerability, a use-after-free, occurs within the `kset_replay` function when a stale key's segment generation is accessed after it has been freed. This could allow a local …
CVE-2026-80950Medium· 5.5⚖ disputedkernel: i3c: renesas: Check that the transfer is valid before accessing it (CVE-2026-80950)
A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but …
CVE-2026-80947High· 7.0⚖ disputedkernel: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (CVE-2026-80947)
A flaw was found in the Linux kernel's `rtl8xxxu` Wi-Fi driver. A race condition exists during the driver's stop process, specifically when handling receive (RX) Universal Serial Bus (USB) Request Blocks (URBs). This allows a worker to acc…
CVE-2026-89534High· 7.0kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (CVE-2026-89534)
A flaw was found in the Linux kernel's `svcrdma` module. This vulnerability occurs when the system attempts to handle an RDMA (Remote Direct Memory Access) address change, and a critical memory allocation fails. This can lead to a 'use-aft…
CVE-2026-89522Medium· 5.5⚖ disputedkernel: media: staging/ipu7: fix async notifier UAF on probe error path (CVE-2026-89522)
A flaw was found in the Linux kernel's media subsystem, specifically within the ipu7 driver. When an error occurs during the device's initial setup (probe error path), a V4L2 asynchronous notifier is not correctly removed from a global lis…
CVE-2026-89486Medium· 5.5⚖ disputedkernel: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows …
CVE-2026-89452Medium· 5.5⚖ disputedkernel: iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
A flaw was found in the `iommu/msm` component of the Linux kernel. This vulnerability occurs when `msm_iommu_probe()` fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could poten…
CVE-2026-89445High· 7.0kernel: iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free (UAF) vulnerability occurs when the TRIGGER_IOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A con…
CVE-2026-89441Medium· 5.5⚖ disputedkernel: mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
A flaw was found in the Linux kernel, specifically within the `mmc: via-sdmmc` driver responsible for managing SD and MultiMediaCard (MMC) devices. This vulnerability occurs during device removal, where a timing issue allows a process to a…
CVE-2026-81006Medium· 5.5⚖ disputedkernel: ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file (sysfs attribute) re…
CVE-2026-89635Medium· 5.5⚖ disputedkernel: ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVE-2026-89635)
A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable hand…
CVE-2026-89624High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
CVE-2026-89622High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
CVE-2026-89600Medium· 5.5⚖ disputedkernel: fanotify: fix use-after-free of file range info (CVE-2026-89600)
A flaw was found in the Linux kernel's fanotify subsystem. This use-after-free vulnerability occurs when the system attempts to report file range information after the memory holding that information has been released. A local attacker cou…
CVE-2026-89564High· 7.8In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use …
In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use …
CVE-2026-89535High· 8.1In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which…
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which…
CVE-2026-89690High· 7.0kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)
A flaw was found in the `nfsd` component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead…
CVE-2026-89689High· 7.0⚖ disputedkernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. A remote attacker could exploit a use-after-free vulnerability in the `nfsd4_sequence()` function. This occurs when the system attempts to reduce the number o…
CVE-2026-89688High· 7.0⚖ disputedkernel: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (CVE-2026-89688)
A flaw was found in the Linux kernel's nfsd component. During a `seqid_op` replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue…
CVE-2026-89682High· 7.0kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net (CVE-2026-89682)
A flaw was found in the Linux kernel's NFS daemon (nfsd) component. The nfsd_file_dispose_list_delayed() function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespac…
CVE-2026-89677High· 7.0⚖ disputedkernel: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() (CVE-2026-89677)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When creating files, the `dentry_create()` function could return an unexpected directory entry (dentry). This could lead to a previously stored dentry being prematur…
CVE-2026-89676Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
CVE-2026-89675High· 7.0⚖ disputedkernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free (UAF) vulnerability. This allows an async copy object to be fr…
CVE-2026-89670High· 7.0kernel: nfsd: hold rcu across localio cmpxchg retry (CVE-2026-89670)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. A race condition exists in the `nfsd_open_local_fh()` function where an `nfsd_file` object can be freed and its memory recycled while another process attem…
CVE-2026-89668High· 7.0⚖ disputedkernel: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() (CVE-2026-89668)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd_debugfs_init()` function is called before `nfsd4_init_slabs()`. If the slab allocation fails, the `nfsd_debugfs_exit()` cleanup function is bypassed, leaving orphaned …
CVE-2026-89660Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The cli…
CVE-2026-89659Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The …
CVE-2026-89658High· 7.0⚖ disputedkernel: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (CVE-2026-89658)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier (stateid) reference does not properly prevent the client from bein…
CVE-2026-89641High· 7.0⚖ disputedkernel: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (CVE-2026-89641)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) module. This vulnerability, a use-after-free, occurs in the `cifs_file_set_size()` function. When a file's size is being modified, a critical system resource (tcon o…