CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
9821 vulnerabilities reference this CWE, most recent first.
GHSA-V4G5-82WJ-3J9W
Vulnerability from github – Published: 2022-05-13 01:52 – Updated: 2022-05-13 01:52An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free.
{
"affected": [],
"aliases": [
"CVE-2018-4218"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-08T18:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \"WebKit\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free.",
"id": "GHSA-v4g5-82wj-3j9w",
"modified": "2022-05-13T01:52:39Z",
"published": "2022-05-13T01:52:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4218"
},
{
"type": "WEB",
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1553"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201808-04"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208848"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208850"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208851"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208852"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208853"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208854"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3687-1"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44861"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4H4-WP66-6Q5X
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2026-05-12 12:31In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.
{
"affected": [],
"aliases": [
"CVE-2024-35789"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T13:15:58Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN\u0027s netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change.",
"id": "GHSA-v4h4-wp66-6q5x",
"modified": "2026-05-12T12:31:46Z",
"published": "2024-05-17T15:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35789"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4HW-Q98X-8JMM
Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-06-30 03:37In the Linux kernel, the following vulnerability has been resolved:
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.
{
"affected": [],
"aliases": [
"CVE-2026-52924"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-825"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T08:16:22Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n sctp_sched_fcfs_dequeue+0x13a/0x140\n sctp_outq_flush+0x1603/0x33e0\n sctp_do_sm+0x31c9/0x5d30\n sctp_assoc_bh_rcv+0x392/0x6f0\n sctp_inq_push+0x1db/0x270\n sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths.",
"id": "GHSA-v4hw-q98x-8jmm",
"modified": "2026-06-30T03:37:10Z",
"published": "2026-06-24T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-52924"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4MC-2F9F-5JW2
Vulnerability from github – Published: 2022-05-14 03:27 – Updated: 2022-05-14 03:27A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
{
"affected": [],
"aliases": [
"CVE-2017-15126"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-14T06:29:00Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().",
"id": "GHSA-v4mc-2f9f-5jw2",
"modified": "2022-05-14T03:27:03Z",
"published": "2022-05-14T03:27:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15126"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/384632e67e0829deb8015ee6ad916b180049d252"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0676"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1062"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-15126"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523481"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=384632e67e0829deb8015ee6ad916b180049d252"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102516"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4MV-7G6H-5VH8
Vulnerability from github – Published: 2023-07-24 18:30 – Updated: 2024-04-25 15:30An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.
{
"affected": [],
"aliases": [
"CVE-2023-3812"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-24T16:15:13Z",
"severity": "HIGH"
},
"details": "An out-of-bounds memory access flaw was found in the Linux kernel\u2019s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"id": "GHSA-v4mv-7g6h-5vh8",
"modified": "2024-04-25T15:30:36Z",
"published": "2023-07-24T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3812"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=363a5328f4b0"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224048"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3812"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2008"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2006"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1961"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0593"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0575"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0563"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0562"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0554"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0412"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0340"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7554"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7418"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7411"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7389"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7382"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7379"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7370"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6813"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6799"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4QH-WP8V-X2XQ
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 03:31Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-10932"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:16:55Z",
"severity": "HIGH"
},
"details": "Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-v4qh-wp8v-x2xq",
"modified": "2026-06-05T03:31:31Z",
"published": "2026-06-05T00:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10932"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/501335606"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4QP-8G92-CJ69
Vulnerability from github – Published: 2026-07-08 09:31 – Updated: 2026-07-08 09:31Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.
{
"affected": [],
"aliases": [
"CVE-2026-13128"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T09:16:29Z",
"severity": "HIGH"
},
"details": "Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.",
"id": "GHSA-v4qp-8g92-cj69",
"modified": "2026-07-08T09:31:48Z",
"published": "2026-07-08T09:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13128"
},
{
"type": "WEB",
"url": "https://www.foxit.com/support/security-bulletins.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V4QW-P44R-QHFG
Vulnerability from github – Published: 2026-06-22 15:30 – Updated: 2026-07-14 18:31Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
{
"affected": [],
"aliases": [
"CVE-2026-6653"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-22T14:17:51Z",
"severity": "HIGH"
},
"details": "Use After Free in libxml2\u0027s xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.",
"id": "GHSA-v4qw-p44r-qhfg",
"modified": "2026-07-14T18:31:47Z",
"published": "2026-06-22T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V4VX-QXH4-8WW4
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-11-24 21:30In the Linux kernel, the following vulnerability has been resolved:
rapidio: fix possible UAF when kfifo_alloc() fails
If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free priv. But priv is still in the chdev->file_list, then list traversal may cause UAF. This fixes the following smatch warning:
drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list
{
"affected": [],
"aliases": [
"CVE-2022-50245"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T14:15:34Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible UAF when kfifo_alloc() fails\n\nIf kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free\npriv. But priv is still in the chdev-\u003efile_list, then list traversal\nmay cause UAF. This fixes the following smatch warning:\n\ndrivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: \u0027\u0026priv-\u003elist\u0027 not removed from list",
"id": "GHSA-v4vx-qxh4-8ww4",
"modified": "2025-11-24T21:30:56Z",
"published": "2025-09-15T15:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50245"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02d7d89f816951e0862147d751b1150d67aaebdd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a6c75adf8192f07ddcdd4a1a13488c890a73919"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2ba06e57f933f0eac242e8b389433da1cc00d4d5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2dfd60724d271a6ab99f93f40f38f2ced1ddbb87"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f5cc7fd73fd6253cc71214f0dd499cc62feb469"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/311b488405ac45af46756b1c8f1d27007b68b07e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5ee850645e42f541ce1ea8130c2b27cc495f965c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a253dde0403a153075ffb254f6f7b2635e49e97a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb87af2c19c0993f6e21f75b963a5599c5a73e76"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V52H-39Q4-CCVW
Vulnerability from github – Published: 2022-07-27 00:00 – Updated: 2022-07-29 00:00Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.
{
"affected": [],
"aliases": [
"CVE-2022-1633"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-26T22:15:00Z",
"severity": "HIGH"
},
"details": "Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.",
"id": "GHSA-v52h-39q4-ccvw",
"modified": "2022-07-29T00:00:30Z",
"published": "2022-07-27T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1633"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1316990"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.