CVE-2025-37924
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->use
CVSS
9.8
Crítica
EPSS
24.5%
p98
KEV
—
Exploit Today
29
0-100
Publicado: 20 de mai. de 2025 · Última mod.: 15 de out. de 2026 · CWE-416
21.2%EPSS · 30 dias24.5%
2026-10-142026-11-11
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.
- git.kernel.orghttps://git.kernel.org/stable/c/28c756738af44a404a91b77830d017bb0c525890
- git.kernel.orghttps://git.kernel.org/stable/c/b447463562238428503cfba1c913261047772f90
- git.kernel.orghttps://git.kernel.org/stable/c/e18c616718018dfc440e4a2d2b94e28fe91b1861
- git.kernel.orghttps://git.kernel.org/stable/c/e34a33d5d7e87399af0a138bb32f6a3e95dd83d2
- git.kernel.orghttps://git.kernel.org/stable/c/e86e9134e1d1c90a960dd57f59ce574d27b9a124
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/08/msg00010.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-126921——
———Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126919——
———Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126918——
———Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126911——
———Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)2hCVE-2026-126909——
———Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126904——
———Use after free in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)2h