glibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfault#use-after-free
QEMU patches QXL use-after-free on hot-unplug
CVE-2026-63322 left VM state handlers and bottom halves pointing at freed device memory after secondary display removal.
By sudoCAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
By kexecQEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudoSockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexecQEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjob