CVE-2022-48873
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on creater_process and device_release
CVSS
7.8
High
EPSS
0.2%
p15
KEV
—
Exploit Today
5
0-100
Published: Aug 21, 2024 · Last modified: Aug 4, 2026 · CWE-416
0.2%EPSS · 30 days0.2%
2026-07-302026-08-26
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on creater_process and device_release Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead. The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0.
- git.kernel.orghttps://git.kernel.org/stable/c/193cd853145b63e670bd73740250983af1475330
- git.kernel.orghttps://git.kernel.org/stable/c/1b7b7bb400dd13dcb03fc6e591bb7ca4664bbec8
- git.kernel.orghttps://git.kernel.org/stable/c/35ddd482345c43d9eec1f3406c0f20a95ed4054b
- git.kernel.orghttps://git.kernel.org/stable/c/4b5c44e924a571d0ad07054de549624fbc04e4d7
- git.kernel.orghttps://git.kernel.org/stable/c/5bb96c8f9268e2fdb0e5321cbc358ee5941efc15
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-819349.8 CRI—
———Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.5hCVE-2026-264489.8 CRI—
———Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.5hCVE-2026-264477.5 HIG—
———Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.5hCVE-2026-580937.0 HIG3.2%
——1The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.
An unprivileged local user can exploit this race condition to escalate privileges.21hCVE-2026-580917.8 HIG5.6%
——2The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.
On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.21hCVE-2026-580907.8 HIG5.6%
——2The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.
An unprivileged local user can exploit this use-after-free to escalate privileges.21h