Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
517 results · Clear filters · Feed
-
Critical 9.8
ksmbd: pin conn during async oplock break notification
In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd…
-
Critical 9.8
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…
-
Critical 9.8
phonet: pep: fix use-after-free in pep_get_sb()
In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing UAF. Re…
-
Critical 9.8
ila: reload IPv6 header after pskb_may_pull in checksum adjust
In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport head…
-
Critical 9.8
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns non-zero), its error path frees the sk with s…
-
Critical 9.6
Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a …
-
Critical 9.6
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially pe…
-
Critical 9.6
Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially …
-
Critical 9.6
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially pe…
-
Critical 9.6
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perfo…
-
Critical 9.8
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to re…
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
Critical 9.6
Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a…
-
Critical 9.6
Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendere…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sand…
-
Critical 9.6
Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had com…
-
Critical 9.6
Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sand…
-
Critical 9.6
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende…
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, …
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macO…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 …
-
Critical 9.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…
-
Critical 9.8
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences c…
-
Critical 9.8
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order frag…
-
Critical 9.8
net/handshake: Take a long-lived file reference at submit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() an…
-
Critical 9.8
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX cha…
-
Critical 9.6
Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised…