CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 moreksmbd: close durable scavenger races against m_fp_list lookups9.8 Critical
- linux, linux kernel +1 moreipv6: ioam: refresh hdr pointer before ioam6_event()9.8 Critical
- linux, linux kernel +1 morenet: hsr: defer node table free until after RCU readers7.8 High
- linux, linux kernel +1 morenet/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover9.8 Critical
- linux, linux kernel +1 morewifi: mac80211: capture fast-RX rate before mesh reuses skb->cb8.8 High
- linux, linux kernel +1 morevsock/vmci: fix UAF when peer resets connection during handshake8.8 High
- linux, linux kernel +1 moreixgbevf: fix use-after-free in VEPA multicast source pruning9.8 Critical
- linux, linux kernel +1 moreaf_unix: Fix UAF read of tail->len in unix_stream_data_wait()8.8 High
- linux, linux kernel +1 morescsi: isci: Fix use-after-free in device removal path7.8 High
- linux, linux kernel +1 moredrm/v3d: Fix use-after-free of CPU job query arrays on error path7.8 High
- linux, linux kernel +1 morebatman-adv: mcast: fix use-after-free in orig_node RCU release8.8 High
- linux, linux kernel +1 morefirmware: arm_ffa: Snapshot notifier callbacks under lock9.3 Critical
- linux, linux kernel +1 morefprobe: Fix unregister_fprobe() to wait for RCU grace period7.8 High
- linux, linux kernel +1 moreirq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT7.8 High
- linux, linux kernel +1 morenvme-pci: fix use-after-free in nvme_free_host_mem()7.8 High
- linux, linux kernel +1 morenetfs: Fix early put of sink folio in netfs_read_gaps()9.8 Critical
- linux, linux kernel +1 moreaccel/qaic: Add overflow check to remap_pfn_range during mmap7.8 High
- linux, linux kernel +1 moredrm/msm/dpu: don't mix devm and drmm functions7.8 High
- linux, linux kernel +1 moreRDMA/rtrs: Fix use-after-free in path file creation cleanup9.8 Critical
- linux, linux kernel +1 morebridge: mcast: Fix a possible use-after-free when removing a bridge port7.8 High
- linux, linux kernel +1 moregpio: aggregator: fix a potential use-after-free7.8 High
- linux, linux kernel +1 moreblk-mq: pop cached request if it is usable7.8 High
- linux, linux kernel +1 moreksmbd: fix durable reconnect error path file lifetime9.8 Critical
- linux, linux kernel +1 morenfc: llcp: Fix use-after-free in llcp_sock_release()7.8 High
- linux, linux kernel +1 morenfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()8.8 High
- linux, linux kernel +1 moreaccel/rocket: fix UAF via dangling GEM handle in create_bo7.8 High
- linux, linux kernel +1 morenetfilter: synproxy: refresh tcphdr after skb_ensure_writable9.8 Critical
- linux, linux kernel +1 moreipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()7.8 High
- linux, linux kernel +1 moreALSA: pcm: oss: Fix setup list UAF on proc write error7.8 High
- linux, linux kernel +1 moretunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()9.8 Critical
- linux, linux kernel +1 morevxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()9.8 Critical
- linux, linux kernel +1 morenet/handshake: hand off the pinned file reference to accept_doit9.8 Critical
- linux, linux kernel +1 moreBluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp8.8 High
- linux, linux kernel +1 morevsock/virtio: bind uarg before filling zerocopy skb7.8 High
- linux, linux kernel +1 morezram: fix use-after-free in zram_writeback_endio7.8 High
- linux, linux kernel +1 moreBluetooth: ISO: fix UAF in iso_recv_frame8.8 High
- linux, linux kernel +1 moreBluetooth: hci_sync: fix UAF in hci_le_create_cis_sync8.8 High
- linux, linux kernel +1 moreiio: buffer: hw-consumer: fix use-after-free in error path7.8 High
- linux, linux kernel +1 moreusb: dwc2: Fix use after free in debug code7.8 High
- linux, linux kernel +1 moreipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()9.8 Critical
- linux, linux kernel +1 moreipv6: exthdrs: refresh nh after handling HAO option9.8 Critical
- linux, linux kernel +1 morexfrm: input: hold netns during deferred transport reinjection8.8 High
- linux, linux kernel +1 morel2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname7.8 High
- linux, linux kernel +1 moreip6: vti: Use ip6_tnl.net in vti6_changelink().8.8 High
- linux, linux kernel +1 moredma-buf: fix UAF in dma_buf_fd() tracepoint7.8 High
- linux, linux kernel +1 moreusb: musb: omap2430: Fix use-after-free in omap2430_probe()8.4 High
- linux, linux kernel +1 moreusbip: vudc: Fix use after free bug in vudc_remove due to race condition7.8 High
- linux, linux kernel +1 moredrm/i915: Fix potential UAF in TTM object purge7.8 High
- linux, linux kernel +1 moremac802154: llsec: add skb_cow_data() before in-place crypto8.8 High
- linux, linux kernel +1 moreapparmor: fix use-after-free in rawdata dedup loop7.8 High
- Show moreLoading…