CWE-911
CVEs classified under CWE-911, newest first.
33 CVEsRSS
CVE-2026-77860Low· 3.7In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was in…
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was in…
CVE-2026-89546Medium· 5.3⚖ disputedkernel: Linux Kernel: Resource management flaw in SUNRPC NFS callback service (CVE-2026-89546)
A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) Network File System (NFS) callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource…
CVE-2026-89692Medium· 5.5⚖ disputedkernel: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue (CVE-2026-89692)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. This vulnerability occurs when a delegation recall operation fails, leaving a critical internal flag uncleared. This prevents subsequent attempts to break the…
CVE-2026-89680High· 7.0⚖ disputedkernel: nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680)
A flaw was found in the Linux kernel's nfsd component. This vulnerability occurs when an inter-server COPY operation fails during its setup phase, leading to improper resource cleanup. Consequently, each failed operation results in a memor…
CVE-2026-89664High· 7.0kernel: nfsd: release OPEN-decoded posix ACLs via op_release (CVE-2026-89664)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing malformed NFSv4 OPEN compound operations that include valid Portable Operating System Interface (POSIX) Access Control List (ACL) attributes, the ker…
CVE-2026-89646Medium· 5.5⚖ disputedkernel: ceph: fix leaked inode reference on writeback abort at umount (CVE-2026-89646)
A flaw was found in the Ceph filesystem component of the Linux kernel. When a writeback operation is aborted during an unmount process, a reference to an inode (a data structure describing a filesystem object) is not properly released. Thi…
CVE-2026-80983Medium· 5.5kernel: net/smc: fix socket refcount leak in smc_switch_conns() (CVE-2026-80983)
A flaw was found in the Linux kernel's implementation of the Server Message Block (SMB) over Remote Direct Memory Access (RDMA) protocol, specifically within the `net/smc` component. An error path in the `smc_switch_conns()` function, trig…
CVE-2026-89576Medium· 5.5kernel: dm-era: fix shadowed superblock leak on take-snap failure (CVE-2026-89576)
A flaw was found in the Linux kernel's device-mapper era (dm-era) component. When a snapshot operation fails, a block of metadata is allocated but not properly freed. This leads to a permanent leak of system resources with each failed atte…
CVE-2026-89735Medium· 4.4kernel: Linux kernel: USB gadget MIDI2 driver resource leak leads to denial of service (CVE-2026-89735)
A flaw was found in the Linux kernel's USB gadget MIDI2 driver. The driver fails to properly remove default configuration file system (configfs) groups during teardown, leading to a resource leak. A local attacker could exploit this vulner…
CVE-2026-89707High· 7.0kernel: nfsd: release path refs on follow_down() error (CVE-2026-89707)
A flaw was found in the Linux kernel's nfsd component. An authenticated Network File System (NFS) client can exploit this vulnerability by triggering a failed cross-mount operation through `nfsd_lookup_dentry` or the NFSv4 READDIR encode p…
CVE-2026-89697High· 7.0⚖ disputedkernel: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When setting file attributes using `nfsd_proc_setattr()`, a specific code path (`BOTH_TIME_SET` branch) prematurely verifies file handles. This bypasses a critical w…
CVE-2026-89715Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
CVE-2026-89447Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
CVE-2026-89590Medium· 5.5kernel: accel/rocket: Fix error path handling in rocket_job_run() (CVE-2026-89590)
A flaw was found in the `accel/rocket` driver within the Linux kernel. Incorrect error handling in the `rocket_job_run()` function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memor…
CVE-2026-89683High· 7.0kernel: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (CVE-2026-89683)
A flaw was found in the Linux kernel's nfsd (NFS daemon). A remote attacker could exploit this vulnerability by sending a specially crafted NFSv3 filehandle targeting a V4ROOT export's file system identifier (fsid). This action triggers a …
CVE-2026-89645Medium· 5.5kernel: btrfs: drop recovered reloc root refs on recovery failure (CVE-2026-89645)
A flaw was found in the btrfs file system in the Linux kernel. During relocation recovery, if an error occurs, such as a memory allocation failure, the system may not properly drop references to relocation roots. This oversight can lead to…
CVE-2026-89757Medium· 5.5kernel: mm/mglru: fix and remove redundant unevictable folio handling (CVE-2026-89757)
A flaw was found in the Linux kernel's memory management unit (MMU), specifically within the multi-generational Least Recently Used (mglru) mechanism. A bug in how the kernel handles unevictable memory pages can lead to these pages remaini…
CVE-2026-89453Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device wi…
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device wi…
CVE-2026-18149Medium· 5.9undici's retry handler can leave an already-exposed response body pending forever
undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retr…
CVE-2026-77587Medium· 5.9Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a cli…
CVE-2026-73415High· 8.0jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObj…
CVE-2026-19380Low· 2.3A vulnerability was identified in Mullvad wireguard.sys 0.10.1
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to …
CVE-2026-64376Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_register() -> fw_create_instance() -> device_initialize() After fw_cre…
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_register() -> fw_create_instance() -> device_initialize() After fw_cre…
CVE-2026-64370Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores…
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores…
CVE-2026-56819High· 7.5PoCio.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompress…
CVE-2026-52943High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header…
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header…
CVE-2026-52947High· 7.8In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the p…
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the p…
CVE-2026-52960High· 7.5⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable for writeback The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the f…
In the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable for writeback The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the f…
CVE-2026-46316Critical· 9.3PoC⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each()…
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each()…
CVE-2026-46099High· 8.1In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_…
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_…