Teardown Season: Dirty Frees, Unauthenticated Races, and the Quiet Patch Economy

MongoDB's catch-up process and GPAC's XMT scene teardown failed the same way this month -- an object gets freed while something else still believes it owns it, and the attacker only has to control the order. CVE-2026-118383 is the loud one: a use-after-free in the server's primary catch-up path that an unauthenticated client can set up, reproduced end to end by Datadog, no creds required -- just attacker-controlled timing against replication state. CVE-2026-128240 is the quiet twin: MP4Box through 26.07.0 frees prototype scene-graph nodes inside gf_sg_proto_del during XMT teardown and then walks them again, CWE-416, CVSS 5.5, AV:L/UI:R, 'crash-only' per the advisory, fixed in a2e5c62c. Crash-only is a statement about the current proof of concept, not about the bug. Both primitives are one thing wearing two hats: a state machine that tears down in one order and dereferences in another, with a free order you can nudge from outside.

Apache's HTTP/2 module is the same disease with a lock missing instead of a refcount. CVE-2026-119618 landed November 11 alongside Praetorian's walkthrough of a critical race in connection and stream handling, and follow-on coverage is already whispering RCE. Treat the whisper as a lead, not a fact -- but check patch levels on anything fronting Apache with h2c enabled, then do the part nobody does: pull the fix commit, map the exact interleaving it guards, and throw that same stream-reset/teardown churn at nghttp2 frontends, Envoy's h2 codec, and Go's net/http2. Race fixes in one h2 stack almost always leave unpatched cousins, because every implementation hand-rolled its own teardown ladder and every one of them thinks it is the careful one.

gVisor shipped the confession without the bulletin: device-cgroup confinement and a missing filestore cleanup path (heads e45d53c7, ab5f509c), then proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration -- all merged under google/gvisor, none of it with an advisory attached. Silent handle-lifetime patches mean somebody worked out how to hold a descriptor open across container death. Same negative-day genre at google/osv.dev: Cloud Run pinned to a least-privilege service account, goose pooled-SQL handling repaired, and RPM version ordering corrected for TuxCare, CentOS, OracleLinux, and RHEL -- that last one is a blind-spot class all its own, since a comparator that sorts el8 against el8_4 wrong silently hides matching advisories. Set against that, watchTowr's Barracuda chain (CVE-2026-116606 + CVE-2026-111560) is almost refreshing in its bluntness: pre-auth remote root on the Email Security Gateway parked on your MX record. One vendor hands out root by default at the perimeter; another quietly repairs descriptor cleanup and hopes nobody diffs which commit was the fix.

The same folded-guard pattern runs through every trust boundary we touched. @albinowax's CSP research shows an allowlisted host serving JSONP, an upload reflector, or an open redirect converts blocked XSS straight back into token theft -- on most production targets script-src is a pre-approved exfil list with a compliance sticker. CVE-2015-10149 is the decade-old edition: Dancer before 1.3400 hands the session cookie's id to the session engine with zero validation, and the YAML, DBI, and Redis handlers all eat the raw string, so the cookie is the vector and the backing store is the sink. Bishop Fox's Proofpoint ITM find drags it local and to root: a standard Mac user creates a file with a crafted name in a OneDrive-managed folder, the File Activity Monitor builds a shell command from that filename without quoting, and the agent executes it as root. The Cursor marketplace hijack is the same failure at registry scale -- stolen Fireworks AI credentials pushed a poisoned Claude Code extension through because the pipeline trusted the upstream account, not the code. Orange Tsai's logic-only Edge chain from Pwn2Own Berlin is the thesis proof: zero memory corruption, full compromise, state machine all the way down.

Then there is the bench, where the same reference-trust question shows up as voltage. osqzss/pluto-crpa stands up a working controlled-reception-pattern array for under $200 -- two elements on a PlutoSDR (AD9363 + Zynq-7010), adaptive weights computed on the PS, combined in the PL, re-radiated at GPS L1 1575.42 MHz into a stock receiver, courtesy of the GPS-SDR-SIM author. krakenrf/krakensdr_suite dropped Python entirely for C++, running real-time spectrum and audio demod concurrently with MUSIC direction finding on a Pi 4/5. portapack-mayhem/mayhem-firmware extended PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO and killed SD corruption via single-beat SDIO IDMAC transfers -- TCXO-locked framing is what keeps a long capture replay on-frequency instead of smearing across the band. Wired together, that is a bench that can spoof, null, and direction-find the same clock. Which is precisely the fight the field reports describe: Ukraine's Lima system meaconing drones and GPS fixes thousands of kilometers off, Peru as a coordinate, and Turk Telekom with Calnex at ITSF 2026 on what happens to PTP and small-cell backhaul timing when L1 goes hostile. Mass spoofing beats per-platform hardening, and telecom holdover is thinner than the slide deck admits.

So the work tonight is teardown-shaped at every layer. Pull e45d53c7 and ab5f509c, trace which handles now close on sandbox death, then hunt the path where an in-flight syscall pins one across container teardown -- Kata and Firecracker jailers likely share the lifecycle. Diff gf_sg_proto_del's free-then-walk order, then fuzz XMT/BT/VRML teardown with nested proto instantiation to see whether the freed node can be groomed with scene data. Rebuild the mod_http2 trigger against patched and unpatched Apache, then replay the churn at nghttp2, Envoy, and Go. Enumerate script-src hosts on scope, run the CSPBypass matchers, and probe every allowlisted host for JSONP and open redirects. Grep endpoint agents for subprocess calls fed by filenames, plant quotes and $(...) in monitored sync folders, and watch what executes. On the bench: second Pluto as a CW and chirp jammer at L1, a u-blox as victim, C/N0 null depth logged against jammer angle, then a third element to see if the PS-side adaptive loop holds under swept jamming. Twenty years of RFCs and these state machines still free objects in the wrong order -- the patch is not the finish line, it is the map.