CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 moremm: call ->free_folio() directly in folio_unmap_invalidate()9.8 Critical
- linux, linux kernel +1 moreKVM: x86: Use scratch field in MMIO fragment to hold small write values8.8 High
- linux, linux kernel +1 moreASoC: qcom: q6apm: move component registration to unmanaged version7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremm: blk-cgroup: fix use-after-free in cgwb_release_workfn()7.8 High
- linux, linux kernel +1 moremedia: mediatek: vcodec: fix use-after-free in encoder release path7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremedia: em28xx: fix use-after-free in em28xx_v4l2_open()7.8 High
- linux, linux kernel +1 morehwmon: (powerz) Fix use-after-free on USB disconnect7.8 High
- linux, linux kernel +1 moreALSA: 6fire: fix use-after-free on disconnect7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebcache: fix cached_dev.sb_bio use-after-free and crash7.8 High
- linux, linux kernel +1 moremedia: as102: fix to not free memory after the device is registered in as102_usb_probe()7.8 High
- linux, linux kernel +1 moremedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()7.8 High
- linux, linux kernel +1 moredrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib7.8 High
- linux, linux kernel +1 morefutex: Require sys_futex_requeue() to have identical flags7.8 High
- linux, linux kernel +1 moretracing: Fix trace_marker copy link list updates7.8 High
- google chromeUse after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who...9.6 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption9.8 Critical
rkyvcrates.iorkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution6.9 Medium- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecan: raw: fix ro->uniq use-after-free in raw_rcv()7.8 High
- openvpnA race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote...6.1 Medium
- linux, linux kernel +1 morecxl/port: Fix use after free of parent_port in cxl_detach_ep()7.8 High
- linux, linux kernel +1 moredriver core: platform: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 morexfrm: prevent policy_hthresh.work from racing with netns teardown7.8 High
- linux, linux kernel +1 moreBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: fix fanout UAF in packet_release() via NETDEV_UP race7.8 High
- linux, linux kernel +1 morenet: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock7.8 High
- linux, linux kernel +1 moreRDMA/efa: Fix use of completion ctx after free7.8 High
- linux, linux kernel +1 moredrm/xe/pf: Fix use-after-free in migration restore7.8 High
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 moredrm/amd/display: Do not skip unrelated mode changes in DSC validation7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morespi: spi-fsl-lpspi: fix teardown order issue (UAF)7.8 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 morecan: isotp: fix tx.buf use-after-free in isotp_sendmsg()7.8 High
- linux, linux kernel +1 moremedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morevirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false7.8 High
- linux, linux kernel +1 morexfs: stop reclaim before pushing AIL during unmount7.8 High
- linux, linux kernel +1 morexfs: save ailp before dropping the AIL lock in push callbacks7.8 High
- linux, linux kernel +1 morexfs: avoid dereferencing log items after push callbacks7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreext4: fix use-after-free in update_super_work when racing with umount7.8 High
- linux, linux kernel +1 moreksmbd: fix use-after-free and NULL deref in smb_grant_oplock()9.8 Critical
- linux, linux kernel +1 moredmaengine: idxd: Fix possible invalid memory access after FLR7.8 High
- powerdns recursorConcurrent modification of RPZ data can lead to denial of servce5.0 Medium
- freebsdKernel use-after-free bug in the TIOCNOTTY handler8.4 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreMemory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 1507.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreMemory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 1507.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 150 and Thunderbird 1507.5 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the Widget: Cocoa component7.5 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the JavaScript Engine component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the WebRTC component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the DOM: Core & HTML component7.5 High
- google chromeUse after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote...7.5 High
- Show moreLoading…