QEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudo#use-after-free
Sockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexecQEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjob