Common Weakness Enumeration
CWE-415
AllowedDouble Free
Abstraction: Variant · Status: Draft
The product calls free() twice on the same memory address.
1082 vulnerabilities reference this CWE, most recent first.
GHSA-2G52-F4RF-8VM9
Vulnerability from github – Published: 2026-02-18 21:31 – Updated: 2026-02-27 00:31
VLAI
Details
A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-12343"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-18T21:16:20Z",
"severity": "LOW"
},
"details": "A flaw was found in FFmpeg\u2019s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free condition, potentially causing FFmpeg or any application using it to crash when processing TensorFlow-based DNN models. This results in a denial-of-service scenario but does not allow arbitrary code execution under normal conditions.",
"id": "GHSA-2g52-f4rf-8vm9",
"modified": "2026-02-27T00:31:44Z",
"published": "2026-02-18T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12343"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-12343"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406533"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-2GWG-MMMC-55J4
Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2025-04-20 03:33
VLAI
Details
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-6074"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-18T21:59:00Z",
"severity": "HIGH"
},
"details": "The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.",
"id": "GHSA-2gwg-mmmc-55j4",
"modified": "2025-04-20T03:33:04Z",
"published": "2022-05-14T03:13:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6074"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0932"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1209"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2017-07-01"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41457"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41458"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2017-07"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0293.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0294.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0295.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0316.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0323.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0324.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0345.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0346.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0347.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0365.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0366.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0403.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0501.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3791"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/22/3"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96310"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2HPW-5CJM-953F
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2025-06-09 15:31
VLAI
Details
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
Severity
{
"affected": [],
"aliases": [
"CVE-2021-27645"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-24T15:15:00Z",
"severity": "MODERATE"
},
"details": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.",
"id": "GHSA-2hpw-5cjm-953f",
"modified": "2025-06-09T15:31:32Z",
"published": "2022-05-24T17:43:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27645"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LZNT6KTMCCWPWXEOGSHD3YLYZKUGMH5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7TS26LIZSOBLGJEZMJX4PXT5BQDE2WS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LZNT6KTMCCWPWXEOGSHD3YLYZKUGMH5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I7TS26LIZSOBLGJEZMJX4PXT5BQDE2WS"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-07"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=27462"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-2HWQ-42HC-RHQV
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2026-06-01 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
In lan78xx_probe(), the buffer buf was being freed twice: once
implicitly through usb_free_urb(dev->urb_intr) with the
URB_FREE_BUFFER flag and again explicitly by kfree(buf). This caused
a double free issue.
To resolve this, reordered kmalloc() and usb_alloc_urb() calls to
simplify the initialization sequence and removed the redundant
kfree(buf). Now, buf is allocated after usb_alloc_urb(), ensuring
it is correctly managed by usb_fill_int_urb() and freed by
usb_free_urb() as intended.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53213"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T14:15:29Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: lan78xx: Fix double free issue with interrupt buffer allocation\n\nIn lan78xx_probe(), the buffer `buf` was being freed twice: once\nimplicitly through `usb_free_urb(dev-\u003eurb_intr)` with the\n`URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused\na double free issue.\n\nTo resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to\nsimplify the initialization sequence and removed the redundant\n`kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring\nit is correctly managed by `usb_fill_int_urb()` and freed by\n`usb_free_urb()` as intended.",
"id": "GHSA-2hwq-42hc-rhqv",
"modified": "2026-06-01T18:31:19Z",
"published": "2024-12-27T15:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53213"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03819abbeb11117dcbba40bfe322b88c0c88a6b6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2970ef2fce90c661952ec2b451b0276d5f8d6180"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ac9f3c981eeceee2ec4d30d850f4a6f50a1ec40"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/977128343fc2a30737399b58df8ea77e94f164bd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a422ebec863d99d5607fb41bb7af3347fcb436d3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b09512aea6223eec756f52aa584fc29eeab57480"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc5aa8e3ad69dcedeba79e667d4a2efb72a305af"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2MG6-CGRH-MG4J
Vulnerability from github – Published: 2025-02-27 03:33 – Updated: 2025-11-03 21:32
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix double free in error path
If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it.
Reviewed by: Ricardo Ribalda ribalda@chromium.org
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-57980"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-27T02:15:11Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix double free in error path\n\nIf the uvc_status_init() function fails to allocate the int_urb, it will\nfree the dev-\u003estatus pointer but doesn\u0027t reset the pointer to NULL. This\nresults in the kfree() call in uvc_status_cleanup() trying to\ndouble-free the memory. Fix it by resetting the dev-\u003estatus pointer to\nNULL after freeing it.\n\nReviewed by: Ricardo Ribalda \u003cribalda@chromium.org\u003e",
"id": "GHSA-2mg6-cgrh-mg4j",
"modified": "2025-11-03T21:32:52Z",
"published": "2025-02-27T03:33:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57980"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3ba8884a56a3eb97c22f0ce0e4dd410d4ca4c277"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6c36dcd662ec5276782838660f8533a7cb26be49"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/87522ef165e5b6de8ef98cc318f3335166a1512c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9232719ac9ce4d5c213cebda23d72aec3e1c4c0d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d1f8e69eec91d5a75ef079778a5d0151db2a7f22"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d6e5ba2516c5bef87c1fcb8189b6f3cad7c64b2d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8e63dd7b6683969d3d47c7b8e9635f96d554ad4"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2MJ9-CV5H-VQXP
Vulnerability from github – Published: 2024-09-18 09:30 – Updated: 2026-08-27 15:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: Fix double free of 'buf' in error path
smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf'
In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful.
But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-46741"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:03Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix double free of \u0027buf\u0027 in error path\n\nsmatch warning:\ndrivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of \u0027buf\u0027\n\nIn fastrpc_req_mmap() error path, the fastrpc buffer is freed in\nfastrpc_req_munmap_impl() if unmap is successful.\n\nBut in the end, there is an unconditional call to fastrpc_buf_free().\nSo the above case triggers the double free of fastrpc buf.",
"id": "GHSA-2mj9-cv5h-vqxp",
"modified": "2026-08-27T15:30:29Z",
"published": "2024-09-18T09:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46741"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4753cc37b6606ef9a7ec22861d380d45e2707f9a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bfc1704d909dc9911a558b1a5833d3d61a43a1f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8c276d4dc0e19ee48385f74426aebc855b49aaf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f77dc8a75859e559f3238a6d906206259227985e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2P8M-H2Q6-92V8
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2023-02-02 21:33
VLAI
Details
A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2019-3896"
],
"database_specific": {
"cwe_ids": [
"CWE-415",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-19T00:15:00Z",
"severity": "HIGH"
},
"details": "A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).",
"id": "GHSA-2p8m-h2q6-92v8",
"modified": "2023-02-02T21:33:42Z",
"published": "2022-05-24T22:00:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1488"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1489"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1490"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2019-3896"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694812"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3896"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190710-0002"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K04327111"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108814"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2PJ7-4M32-XVMQ
Vulnerability from github – Published: 2024-07-09 18:30 – Updated: 2024-07-09 18:30
VLAI
Details
Windows MultiPoint Services Remote Code Execution Vulnerability
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-30013"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T17:15:15Z",
"severity": "HIGH"
},
"details": "Windows MultiPoint Services Remote Code Execution Vulnerability",
"id": "GHSA-2pj7-4m32-xvmq",
"modified": "2024-07-09T18:30:49Z",
"published": "2024-07-09T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30013"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30013"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2PVH-447J-V7M6
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-06-19 15:33
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
spi: meson-spicc: Fix double-put in remove path
meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm cleanup.
Calling spi_controller_put() again in meson_spicc_remove() causes a double-put.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-31489"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:46Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: meson-spicc: Fix double-put in remove path\n\nmeson_spicc_probe() registers the controller with\ndevm_spi_register_controller(), so teardown already drops the\ncontroller reference via devm cleanup.\n\nCalling spi_controller_put() again in meson_spicc_remove()\ncauses a double-put.",
"id": "GHSA-2pvh-447j-v7m6",
"modified": "2026-06-19T15:33:08Z",
"published": "2026-04-22T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31489"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/01f5f7976c24d6e9beef6b5a410af3b9b1d4d476"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7434c64ddae88a02e7fb478bc256cc100d48d3e3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d61bcec3aec6f0244a9b963e0c76c00f771d49b6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2Q4X-W73P-VJF4
Vulnerability from github – Published: 2026-09-14 18:31 – Updated: 2026-09-14 18:31
VLAI
Details
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2026-85921"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T18:20:20Z",
"severity": "HIGH"
},
"details": "Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-2q4x-w73p-vjf4",
"modified": "2026-09-14T18:31:25Z",
"published": "2026-09-14T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85921"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Choose a language that provides automatic memory management.
Mitigation
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Mitigation
Implementation
Use a static analysis tool to find double free instances.
No CAPEC attack patterns related to this CWE.