Kernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
By oops#use-after-free
Stable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecKernel fixes UAFs in POSIX CPU timers on non-leader exec
TID swaps left timer PID references pointing at the wrong task, corrupting signal lists and freeing still-queued structures.
By kexecLinux plugs UAF holes in POSIX CPU timers on non-leader exec
Fixes stop list corruption and premature frees when a non-leader thread execs and TIDs are swapped under live timers.
By kexecTor 0.4.9.12 patches high-severity UAFs and drops TAP keys
The security release fixes multiple memory-safety flaws and requires relays to upgrade before authorities reject legacy descriptors.
By tarpitDRM scheduler fence UAF still open after two driver CVEs
A core use-after-free in timeline-name handling still hits amdxdna, nouveau, and msm, and a proposed cache fix was pulled after lifetime objections.
By kexecDRM scheduler core plugs fence timeline use-after-free
Unprivileged userspace could read freed GPU scheduler memory via timeline name queries on amdxdna, nouveau, and msm.
By oopsLinux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
By kexecDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecKernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
By kexecKernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsglibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultQEMU patches QXL use-after-free on hot-unplug
CVE-2026-63322 left VM state handlers and bottom halves pointing at freed device memory after secondary display removal.
By sudoCAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
By kexecQEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudoSockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexecQEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjob