CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 moreipvs: clear the svc scheduler ptr early on edit7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenet/sched: act_api: use RCU with deferred freeing for action lifecycle7.8 High
- linux, linux kernel +1 morel2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()7.8 High
- linux, linux kernel +1 moretcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().9.8 Critical
- linux, linux kernel +1 moreipv6: anycast: insert aca into global hash under idev->lock7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()8.0 High
- linux, linux kernel +1 morenet: airoha: Fix use-after-free in metadata dst teardown8.8 High
- linux, linux kernel +1 morenet: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown9.8 Critical
- linux, linux kernel +1 morexfrm: iptfs: fix use-after-free on first_skb in __input_process_payload8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morexfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()7.8 High
- linux, linux kernel +1 morenet: ibm: emac: Fix use-after-free during device removal7.8 High
- linux, linux kernel +1 morenet: phy: clean the sfp upstream if phy probing fails8.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreipv6: sit: reload inner IPv6 header after GSO offloads9.8 Critical
- linux, linux kernel +1 morenet: mvpp2: refill RX buffers before XDP or skb use9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nft_tunnel: fix use-after-free on object destroy7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL8.8 High
- linux, linux kernel +1 moreALSA: timer: Forcibly close timer instances at closing7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreALSA: timer: Fix UAF at snd_timer_user_params()7.8 High
- linux, linux kernel +1 moremm/huge_memory: update file PMD counter before folio_put()7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morezram: fix use-after-free in zram_bvec_write_partial()7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moreinet: frags: fix use-after-free caused by the fqdir_pre_exit() flush9.8 Critical
- linux, linux kernel +1 moremisc: fastrpc: fix use-after-free of fastrpc_user in workqueue context7.8 High
- linux, linux kernel +1 moremisc: fastrpc: fix use-after-free race in fastrpc_map_create7.8 High
- linux, linux kernel +1 morenet: phonet: free phonet_device after RCU grace period7.8 High
- linux, linux kernel +1 morenvmem: core: fix use-after-free bugs in error paths7.8 High
- openbsdsys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege...7.4 High
- nlnet labs nsdDenial of DNS over TLS service by any DoT client8.7 High
- gpacA use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC...6.1 Medium
- gpacA use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC...7.8 High
- google chromeUse after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local...7.8 High
- google chromeUse after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to...8.8 High
- google chromeUse after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote...8.8 High
- google chromeUse after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to...8.8 High
- google chromeUse after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker...7.5 High
- google chromeUse after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker...8.8 High
- google chromeUse after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a...8.8 High
- google chromeUse after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote...8.8 High
- google chromeUse after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...9.6 Critical
- google chromeUse after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...9.6 Critical
- linux, linux kernel +1 morefs/mbcache: cancel shrink work before destroying the cache7.8 High
- linux, linux kernel +1 morePCI: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 moreplatform/wmi: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 morevdpa: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 mores390/cio: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 mores390/ap: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 morebus: fsl-mc: use generic driver_override infrastructure7.8 High
- linux, linux kernel +1 morewifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet7.8 High
- linux, linux kernel +1 morepowerpc/pgtable-frag: Fix bad page state in pte_frag_destroy7.8 High
- linux, linux kernel +1 morewifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()7.8 High
- linux, linux kernel +1 morewifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()7.8 High
- Show moreLoading…