use-after-free

A fresh libsoup flaw tracked as CVE-2026-2436 is a reminder that even mature HTTP libraries can fail in ways that look small on paper but matter greatly in production. According to the public record, a remote attacker can trigger a use-after-free in SoupServer when soup_server_disconnect() frees...

CISA’s April 1 update is a reminder that the Known Exploited Vulnerabilities Catalog remains one of the most operationally important signals in federal cybersecurity. The agency says it has added CVE-2026-5281, described as a Google Dawn use-after-free vulnerability, based on evidence of active...

Overview Google’s disclosure of CVE-2026-4676 is a reminder that browser security in 2026 is still defined by speed, scale, and careful operational hygiene rather than by any illusion of “safe browsing.” The flaw is a use-after-free in Dawn, the graphics stack used by Chromium, and it affects...

The Linux kernel’s CVE-2026-23336 is a classic example of a small-looking race condition with outsized consequences: a use-after-free in the Wi-Fi configuration stack, specifically around cfg80211 and rfkill_block work. The upstream fix is straightforward in concept—cancel the pending work...

The Linux kernel’s CVE-2026-23392 is a narrow but serious use-after-free issue in the nf_tables flowtable error path, and its significance comes from the kind of bug it is rather than the drama of its description. According to the kernel.org-stamped NVD text, the bug can expose a flowtable to...

CVE-2026-23319 is a classic example of how a small-looking kernel lifetime bug can become a real security concern once concurrency enters the picture. The Linux kernel issue sits in the BPF trampoline path, where a use-after-free can emerge when bpf_trampoline_link_cgroup_shim races with delayed...

The Linux kernel’s netfilter subsystem is getting an important corrective update for CVE-2026-23351, a flaw in the nft_set_pipapo set backend that can lead to a use-after-free condition and a local denial of service. The fix is not a simple bounds check or a small cleanup; it restructures...

CVE-2026-23340 has drawn attention because it sits squarely in a part of the Linux networking stack that most people never think about until something goes wrong: the qdisc layer that schedules packets before they hit a NIC. The bug is a race condition in the tx-queue shrinking path that can...

Google’s latest Chrome security update closes CVE-2026-4445, a use-after-free vulnerability in WebRTC that affected Chrome builds prior to 146.0.7680.153 and could let a remote attacker trigger heap corruption with a crafted HTML page. The defect has been classified as High severity, which...

The release of CVE-2026-4456 is another reminder that browser security increasingly hinges on tiny memory-lifetime mistakes with outsized consequences. Google says the flaw is a use-after-free in the Digital Credentials API, affecting Chrome versions before 146.0.7680.153, and that a remote...

The CVE-2026-4458 disclosure is a reminder that browser security still lives and dies by the smallest memory-management mistakes. According to the Microsoft Security Update Guide entry, the flaw is a use-after-free in Chromium Extensions affecting Google Chrome before 146.0.7680.153, and the...

Chromium’s CVE-2026-4454 is the kind of browser bug that can quietly become an enterprise headache long after the initial patch lands. Google describes it as a use-after-free in Network that could let a remote attacker potentially trigger heap corruption through a crafted HTML page, and it...

The page for CVE-2026-23191 is currently unavailable on Microsoft’s update guide, but the underlying Linux kernel issue is identifiable: ALSA: aloop: Fix racy access at PCM trigger. The upstream stable patch says the PCM trigger callback in the aloop driver was checking PCM state and stopping...

CVE-2026-23221 is another reminder that small-looking kernel bugs can have large security consequences: Microsoft’s update guide entry appears to have been removed or is temporarily unavailable, but the vulnerability title itself points to a use-after-free in the Linux fsl-mc bus code...

The Linux kernel’s perf subsystem has a new security-flavored bug fix on the table: CVE-2026-23248, described as a refcount bug and potential use-after-free in perf_mmap. The Microsoft Security Response Center entry currently returns a not-found page, but the title itself is enough to tell a...

Microsoft has recorded CVE-2026-26132 as a Windows Kernel use‑after‑free vulnerability that can be triggered by an authorized local user to gain elevated privileges, and administrators should treat it as a high‑priority remediation item in this month’s Patch Tuesday release. (msrc.microsoft.com)...

Microsoft has recorded CVE-2026-25171 as a local elevation-of-privilege (EoP) bug in Windows Authentication Methods — a use‑after‑free in authentication code that, if triggered by an already authorized local actor, can elevate privileges on an affected host; Microsoft’s advisory entry and...

Microsoft has published details for CVE-2026-25167, a use‑after‑free elevation‑of‑privilege flaw in the Microsoft Brokering File System (BFS) that can allow a locally‑accessible attacker to escalate to SYSTEM‑level privileges on unpatched machines; Microsoft lists the vulnerability in the March...

The Linux kernel's netfilter subsystem has a new, high-consequence memory-corruption fix that any Linux systems team running nftables must treat as urgent: CVE-2026-23231 patches a race-triggered use-after-free in nf_tables_addchain() that can leave published chain objects accessible to active...

The Linux kernel received a targeted fix for a subtle but potentially disruptive race condition in the NFS daemon (nfsd) that could lead to memory being accessed after it was freed. Tracked as CVE-2026-22980, the issue centers on handling of the NFSv4 grace period end — specifically the...