CWE-825
CVEs classified under CWE-825, newest first.
181 CVEsRSS
CVE-2026-89769Medium· 5.5kernel: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (CVE-2026-89769)
A flaw was found in the Linux kernel's NXP PIT (Programmable Interrupt Timer) clocksource driver. When the CPU hotplug setup fails after an interrupt request (IRQ) has been successfully registered, the error handling does not properly free…
CVE-2026-89764Medium· 5.5⚖ disputedkernel: rust: devres: fix race between concurrent revokers (CVE-2026-89764)
A flaw was found in the Linux kernel's `rust: devres` component. A race condition exists when two processes attempt to revoke a `Devres` resource concurrently. This can lead to a use-after-free vulnerability, where one process might free r…
CVE-2026-89763High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type…
CVE-2026-89762Medium· 5.5⚖ disputedkernel: apparmor: fix cred UAF caused by begin_current_label_crit_section() (CVE-2026-89762)
A flaw was found in the Linux kernel's AppArmor security module. The begin_current_label_crit_section() function, used in various Linux Security Module (LSM) hooks, attempts to replace user credentials when a security label becomes stale. …
CVE-2026-89760High· 7.0⚖ disputedkernel: mm, swap: don't free a hibernation slot that is in the swap cache (CVE-2026-89760)
A flaw was found in the Linux kernel's memory management (mm) and swap subsystem. This vulnerability occurs when the swap_free_hibernation_slot() function incorrectly frees a hibernation slot while a memory page (folio) is still present in…
CVE-2026-89755High· 7.8In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap…
CVE-2026-89747High· 7.0⚖ disputedkernel: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (CVE-2026-89747)
A flaw was found in the Linux kernel's tracing component. A local attacker could exploit a use-after-free vulnerability, a type of memory corruption, by manipulating the `trace_pipe` functionality. This occurs when the system attempts to r…
CVE-2026-89738Medium· 5.5⚖ disputedkernel: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (CVE-2026-89738)
A flaw was found in the Linux kernel's `at91_udc` USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering…
CVE-2026-89708Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
CVE-2026-89703High· 7.0⚖ disputedkernel: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (CVE-2026-89703)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd4_drop_revoked_stid()` function, which handles admin-revoked delegations, fails to correctly set a status flag before releasing a lock. This oversight can lead to a use…
CVE-2026-80979High· 7.0kernel: net/smc: unregister the connection before draining the rx tasklet (CVE-2026-80979)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) component. During connection termination, the SMC component may fail to properly unregister a connection before draining its receive tasklet. This can lead to a use-…
CVE-2026-80971High· 7.0kernel: ALSA: bcd2000: clear the URB pointers on disconnect (CVE-2026-80971)
A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block (URB) pointers…
CVE-2026-80928Medium· 5.5⚖ disputedkernel: smack: fix cred UAF in smack_file_send_sigiotask() (CVE-2026-80928)
A flaw was found in the Linux kernel's SMACK (Simplified Mandatory Access Control Kernel) security module. Incorrect handling of task credentials within the smack_file_send_sigiotask() function can lead to a Use-After-Free (UAF) vulnerabil…
CVE-2026-89440High· 7.0kernel: mmc: via-sdmmc: stop card-detect handling on probe failure (CVE-2026-89440)
A flaw was found in the Linux kernel's mmc: via-sdmmc component. During the probe process, if the `mmc_add_host()` function fails, the SD card-detect interrupt handler continues to operate on memory that has already been released. This can…
CVE-2026-81008High· 7.0kernel: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (CVE-2026-81008)
A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers…
CVE-2026-81001High· 7.0kernel: slip: fix use-after-free in sl_sync() (CVE-2026-81001)
A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. A race condition in the `sl_sync()` function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after …
CVE-2026-80994High· 7.0kernel: net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)
A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing …
CVE-2026-80982High· 7.0kernel: net/smc: fix use-after-free in smc_rx_pipe_buf_release() (CVE-2026-80982)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) network protocol. A race condition occurs when a network connection is closed while the system is still processing its receive buffer pages. This can lead to a use-a…
CVE-2026-89479High· 7.0⚖ disputedkernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the ker…
CVE-2026-89478High· 7.0⚖ disputedkernel: sctp: drop a chunk if its transport was removed (CVE-2026-89478)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to…
CVE-2026-89475Medium· 5.5kernel: power: supply: bq24257: fix use-after-free on remove (CVE-2026-89475)
A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the `bq24257` power supply driver. This issue occurs when the STAT-pin interrupt handler attempts to reschedule work and access memory that has already been fre…
CVE-2026-89474Medium· 5.5kernel: power: supply: bq256xx: drain usb_work before freeing the charger (CVE-2026-89474)
A flaw was found in the Linux kernel's power supply subsystem, specifically within the bq256xx driver. This vulnerability occurs when a USB work item attempts to access a charger object after it has been freed. This timing issue can lead t…
CVE-2026-89469Medium· 5.5⚖ disputedkernel: power: supply: lp8727: fix use-after-free in lp8727_release_irq() (CVE-2026-89469)
A flaw was found in the Linux kernel's lp8727 power supply driver. A race condition can occur during the release of an interrupt request (IRQ), where a delayed work item might be re-armed after the associated memory has been freed. This ca…
CVE-2026-89465Medium· 5.5⚖ disputedkernel: power: supply: rt9455: quiesce delayed work before teardown (CVE-2026-89465)
A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task…
CVE-2026-89464Medium· 5.5kernel: power: supply: twl4030_charger: cancel workers via devm (CVE-2026-89464)
A flaw was found in the Linux kernel's `twl4030_charger` driver. When the driver's remove function is called, it fails to properly cancel pending worker tasks. This oversight allows a worker to attempt to access memory that has already bee…
CVE-2026-89548High· 7.0kernel: SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)
A flaw was found in the Linux kernel's SUNRPC component. When `sunrpc_destroy_cache_detail()` is called, it may not properly drain the `cache_cleaner` before freeing a `cache_detail` object. This oversight can lead to a use-after-free vuln…
CVE-2026-89510High· 7.0kernel: RDMA/cxgb4: Cancel reg_work before freeing device on remove (CVE-2026-89510)
A flaw was found in the Linux kernel's RDMA/cxgb4 component. This vulnerability occurs when the `c4iw_remove()` function frees a device while its registration work (`reg_work`) is still pending or actively running. This timing issue can le…
CVE-2026-89504Medium· 5.5⚖ disputedkernel: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (CVE-2026-89504)
A flaw was found in the Linux kernel's regulator subsystem. This vulnerability arises from a programming error where a device tree node pointer is released too early, creating a "dangling pointer"—a reference to memory that is no longer va…
CVE-2026-89488High· 7.0kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
A flaw was found in the Linux kernel's Open vSwitch (OVS) component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packe…
CVE-2026-89485High· 7.0⚖ disputedkernel: lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)
A flaw was found in the `lockd` component of the Linux kernel. This use-after-free vulnerability occurs in the `nlm_traverse_files()` function when a file's memory is prematurely released while an iterator still holds a pointer to it. A re…