CVE-2024-27392
In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() W
CVSS
7.8
Alto
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Publicado: 1 may 2024 · Última mod.: 4 ago 2026 · CWE-415
0.3%EPSS · 30 días0.3%
2026-08-032026-08-31
In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() When nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns before it returns. However, ns_update_nuse() calls kfree() for the pointer even when nvme_identify_ns() fails. This results in KASAN double-free, which was observed with blktests nvme/045 with proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvme_identify_ns() fails.
- git.kernel.orghttps://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb
- git.kernel.orghttps://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3
- git.kernel.orghttps://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb
- git.kernel.orghttps://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-826772.4 BAJ—
——0A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.21hCVE-2026-19316—24.6%
——7A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.4dCVE-2026-751595.9 MED18.0%
——5An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.4dCVE-2026-187987.5 ALT72.1%
——22Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
when channel creation fails for initial packet.
Impact summary: Double free leads to heap corruption, which typically results in
termination of QUIC server process, leading to Denial of Service. There is so
far no evidence that this double free is exploitable for remote code execution,
thus it is considered highly improbable.
CWE: CWE-415: Double Free
Description: In order to validate initial packet, OpenSSL QUIC stack default
packet handler (port_default_packet_handler()) creates a so-called QRX object.
If the initial packet validates successfully with QRX object, the default packet
handler proceeds to channel (connection object) creation. The QRX object used
for packet validation is passed to port_bind_channel(), so it becomes part of
the newly created connection. If port_bind_channel() fails, then it also frees
the QRX object. Once port_bind_channel() returns, the port_default_packet_handler()
detects the failure and proceeds to the error branch, where the same QRX object is
freed for the second time.
The failure in port_bind_channel() function can be induced with a relatively
low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet
carries DCID (destination connection ID) which is shorter than 8 bytes, then
port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()
detects that the DCID has invalid length.
FIPS impact: no
The FIPS module is not affected, as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.4dCVE-2026-478957.5 ALT49.5%
——15In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.8dCVE-2026-452025.5 MED1.2%
——0Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption.
Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free event.5d