CVE-2024-46831
In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a
CVSS
8.4
Alto
EPSS
0.2%
p15
KEV
—
Exploit Today
5
0-100
Publicado: 27 sept 2024 · Última mod.: 4 ago 2026 · CWE-416
0.2%EPSS · 30 días0.2%
2026-07-302026-08-26
In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-819349.8 CRÍ—
———Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.7hCVE-2026-264489.8 CRÍ—
———Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.7hCVE-2026-264477.5 ALT—
———Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.7hCVE-2026-580937.0 ALT3.2%
——1The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.
An unprivileged local user can exploit this race condition to escalate privileges.23hCVE-2026-580917.8 ALT5.6%
——2The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.
On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.23hCVE-2026-580907.8 ALT5.6%
——2The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.
An unprivileged local user can exploit this use-after-free to escalate privileges.23h